diff --git a/research/finding_identity/gt_agreement.py b/research/finding_identity/gt_agreement.py
new file mode 100644
index 0000000..9aa616a
--- /dev/null
+++ b/research/finding_identity/gt_agreement.py
@@ -0,0 +1,248 @@
+# SPDX-License-Identifier: Apache-2.0
+
+"""Score the manual ground-truth check: how often the harness's truth holds, per rater,
+and how well two raters agree.
+
+``python -m research.finding_identity.gt_agreement --human <labels> --agent <labels>``
+reads the key (``sample.csv`` from :mod:`gt_sample`) and each rater's labels, keyed by
+the blinded item id, and writes ``agreement.md`` next to the key.
+
+Labels: a JSON object ``{item: {"verdict": ...}}``, or a directory of ``<item>.json``
+files (as the labelling page's store exports them). A ``pair`` verdict of ``same`` and an
+``introduced`` verdict of ``new`` confirm the harness's truth; ``different`` and
+``existed`` contradict it; ``unclear`` counts for neither.
+
+``--adjudicated`` adds the final verdict per item (same format, each with a ``source``
+saying who settled it). With ``--results`` (the corpus replays the sample came from),
+the report also estimates each content scheme's hidden rate after removing the
+ground-truth errors: every hidden finding of those schemes lies in the
+``new_but_matched`` stratum, so its count is scaled by the share of that scheme's
+sampled matches that the adjudication confirms as truly new.
+"""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+from collections import Counter
+from collections.abc import Mapping, Sequence
+from pathlib import Path
+
+from .gt_sample import CONTENT_SCHEMES
+from .stats import wilson
+
+HERE = Path(__file__).parent
+KEY = HERE / "paper" / "ground_truth_check" / "sample.csv"
+
+CONFIRMS = {"same", "new"}
+CONTRADICTS = {"different", "existed"}
+
+
+def load_labels(path: Path) -> dict[str, str]:
+    """``{item: verdict}`` from a JSON file or a directory of per-item JSON files."""
+    if path.is_dir():
+        out = {}
+        for f in sorted(path.rglob("*.json")):
+            body = json.loads(f.read_text(encoding="utf-8"))
+            body = body.get("data", body) if isinstance(body, dict) else {}
+            if isinstance(body, dict) and isinstance(body.get("verdict"), str):
+                out[f.stem] = body["verdict"]
+        return out
+    raw = json.loads(path.read_text(encoding="utf-8"))
+    return {k: v["verdict"] for k, v in raw.items() if isinstance(v, dict) and "verdict" in v}
+
+
+def judgement(verdict: str | None) -> str:
+    """``confirms``, ``contradicts`` or ``unclear`` (also for a missing label)."""
+    if verdict in CONFIRMS:
+        return "confirms"
+    if verdict in CONTRADICTS:
+        return "contradicts"
+    return "unclear"
+
+
+def cohen_kappa(a: Sequence[str], b: Sequence[str]) -> float | None:
+    """Cohen's kappa for two equally long label sequences; ``None`` if undefined."""
+    n = len(a)
+    if n == 0 or n != len(b):
+        return None
+    observed = sum(x == y for x, y in zip(a, b, strict=True)) / n
+    ca, cb = Counter(a), Counter(b)
+    expected = sum(ca[k] * cb[k] for k in ca.keys() | cb.keys()) / (n * n)
+    if expected == 1:
+        return None
+    return (observed - expected) / (1 - expected)
+
+
+def precision_rows(
+    key: Sequence[Mapping[str, str]], labels: Mapping[str, str], group: str
+) -> list[tuple[str, int, int, int]]:
+    """Per value of *group* (and overall): (name, confirms, contradicts, unclear)."""
+    groups: dict[str, Counter[str]] = {}
+    for row in key:
+        j = judgement(labels.get(row["item"]))
+        for name in (row[group], "all"):
+            groups.setdefault(name, Counter())[j] += 1
+    names = [*sorted(n for n in groups if n != "all"), "all"]
+    return [
+        (n, groups[n]["confirms"], groups[n]["contradicts"], groups[n]["unclear"]) for n in names
+    ]
+
+
+def _kind(row: Mapping[str, str]) -> str:
+    return "introduced" if row["truth"] == "new" else "pair"
+
+
+def report(
+    key: Sequence[Mapping[str, str]],
+    raters: Mapping[str, Mapping[str, str]],
+    *,
+    header: bool = True,
+) -> str:
+    rows = [{**r, "kind": _kind(r)} for r in key]
+    out = (
+        [
+            "# Ground-truth check: results",
+            "",
+            "Generated by `research/finding_identity/gt_agreement.py`. *Holds* is the share of",
+            "decided items (unclear left out) where the rater confirms the harness's truth, with",
+            "a Wilson 95% interval.",
+            "",
+        ]
+        if header
+        else []
+    )
+    for name, labels in raters.items():
+        labelled = sum(1 for r in rows if r["item"] in labels)
+        out += [f"## {name}", "", f"{labelled} of {len(rows)} items labelled.", ""]
+        for group in ("kind", "stratum"):
+            out += [
+                f"| {group} | confirms | contradicts | unclear | holds | 95% CI |",
+                "|---|---:|---:|---:|---:|---|",
+            ]
+            for g, yes, no, unclear in precision_rows(rows, labels, group):
+                ci = wilson(yes, yes + no)
+                rate = f"{100 * yes / (yes + no):.1f}%" if yes + no else "n/a"
+                cis = f"[{100 * ci[0]:.1f}, {100 * ci[1]:.1f}]" if ci else "n/a"
+                out.append(f"| {g} | {yes} | {no} | {unclear} | {rate} | {cis} |")
+            out.append("")
+    names = list(raters)
+    if len(names) == 2:
+        both = [r for r in rows if r["item"] in raters[names[0]] and r["item"] in raters[names[1]]]
+        a = [judgement(raters[names[0]][r["item"]]) for r in both]
+        b = [judgement(raters[names[1]][r["item"]]) for r in both]
+        kappa = cohen_kappa(a, b)
+        agree = sum(x == y for x, y in zip(a, b, strict=True))
+        out += [
+            f"## Agreement between {names[0]} and {names[1]}",
+            "",
+            f"On the {len(both)} items both labelled (confirms / contradicts / unclear):",
+            f"{agree} agree ({100 * agree / len(both):.1f}%), Cohen's kappa "
+            + (f"{kappa:.2f}." if kappa is not None else "undefined.")
+            if both
+            else "No item is labelled by both.",
+            "",
+        ]
+        disputed = [r["item"] for r, x, y in zip(both, a, b, strict=True) if x != y]
+        if disputed:
+            out += ["Items to adjudicate: " + ", ".join(disputed) + ".", ""]
+    return "\n".join(out)
+
+
+def corrected_hidden(
+    key: Sequence[Mapping[str, str]], adjudicated: Mapping[str, str], results: Path
+) -> list[str]:
+    """Markdown lines: each content scheme's hidden rate before and after correction."""
+    hidden: Counter[str] = Counter()
+    introduced = 0
+    for f in sorted(results.glob("*/findings.jsonl")):
+        with f.open(encoding="utf-8") as fh:
+            for line in fh:
+                rec = json.loads(line)
+                if rec["truth"] != "new":
+                    continue
+                introduced += 1
+                for scheme in CONTENT_SCHEMES:
+                    hidden[scheme] += rec["outcomes"][scheme] == "false_known"
+    sample = [r for r in key if r["stratum"] == "new_but_matched"]
+    out = [
+        "## Hidden rates after correcting the ground truth",
+        "",
+        f"From `{results}`: {introduced:,} introduced findings. *Matched, sampled*: the",
+        "scheme's hidden findings among the sampled `new_but_matched` items; *truly new*:",
+        "those the adjudication confirms as new. The corrected rate scales the hidden",
+        "count by that share (range: its Wilson 95% interval).",
+        "",
+        "| scheme | hidden | matched, sampled | truly new | corrected hidden | range |",
+        "|---|---:|---:|---:|---:|---|",
+    ]
+    for scheme in CONTENT_SCHEMES:
+        rows = [r for r in sample if scheme in r["disagreeing_schemes"].split()]
+        new = sum(judgement(adjudicated.get(r["item"])) == "confirms" for r in rows)
+        ci = wilson(new, len(rows))
+        rate = hidden[scheme] / introduced if introduced else 0.0
+        if not rows or ci is None:
+            out.append(f"| `{scheme}` | {100 * rate:.2f}% | 0 | 0 | n/a | n/a |")
+            continue
+        corrected = rate * new / len(rows)
+        out.append(
+            f"| `{scheme}` | {100 * rate:.2f}% ({hidden[scheme]}) | {len(rows)} | {new} | "
+            f"{100 * corrected:.2f}% | [{100 * rate * ci[0]:.2f}, {100 * rate * ci[1]:.2f}] |"
+        )
+    return [*out, ""]
+
+
+def main(argv: list[str] | None = None) -> None:
+    ap = argparse.ArgumentParser(prog="python -m research.finding_identity.gt_agreement")
+    ap.add_argument("--key", type=Path, default=KEY, help="sample.csv from gt_sample")
+    ap.add_argument("--human", type=Path, help="the person's labels (file or directory)")
+    ap.add_argument(
+        "--agent",
+        type=Path,
+        action="append",
+        help="the agent rater's labels (file or directory); repeat it, and later files "
+        "override earlier ones, item by item",
+    )
+    ap.add_argument(
+        "--human-kind",
+        choices=["pair", "introduced"],
+        help="score only the person's labels of this item kind",
+    )
+    ap.add_argument("--adjudicated", type=Path, help="final verdicts, with their sources")
+    ap.add_argument("--results", type=Path, help="the replays the sample came from")
+    ap.add_argument("--out", type=Path, help="default: agreement.md next to the key")
+    args = ap.parse_args(argv)
+    with args.key.open(newline="", encoding="utf-8") as f:
+        key = list(csv.DictReader(f))
+    raters = {}
+    if args.human:
+        human = load_labels(args.human)
+        if args.human_kind:
+            kinds = {r["item"]: _kind(r) for r in key}
+            human = {k: v for k, v in human.items() if kinds.get(k) == args.human_kind}
+        raters["Human rater"] = human
+    if args.agent:
+        agent: dict[str, str] = {}
+        for path in args.agent:
+            agent.update(load_labels(path))
+        raters["Agent rater"] = agent
+    if not raters:
+        raise SystemExit("give --human and/or --agent")
+    text = report(key, raters)
+    if args.adjudicated:
+        final = load_labels(args.adjudicated)
+        raw = json.loads(args.adjudicated.read_text(encoding="utf-8"))
+        sources = Counter(str(v.get("source", "unknown")) for v in raw.values())
+        text += "\n" + report(key, {"Adjudicated": final}, header=False)
+        text += "\nSources of the adjudicated verdicts:\n\n"
+        text += "\n".join(f"- {n}: {src}" for src, n in sources.most_common()) + "\n"
+        if args.results:
+            text += "\n" + "\n".join(corrected_hidden(key, final, args.results))
+    out = args.out or args.key.parent / "agreement.md"
+    out.write_text(text.rstrip("\n") + "\n", encoding="utf-8")
+    print(f"wrote {out}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/research/finding_identity/gt_sample.py b/research/finding_identity/gt_sample.py
index ea2b22b..b16f0a5 100644
--- a/research/finding_identity/gt_sample.py
+++ b/research/finding_identity/gt_sample.py
@@ -16,7 +16,13 @@
 It writes ``sample.md``, one entry per finding with the code before and after the commit
 and a link to the commit, and ``sample.csv`` with an empty ``verdict`` column to fill in:
 ``same`` (the old and new finding are the same issue), ``different``, or ``unclear``.
-The sample is seeded, so rerunning it gives the same findings.
+
+For independent raters it also writes ``items.json``: the same findings, shuffled under
+neutral ids (``sample.csv``'s ``item`` column is the key), without the harness's answer,
+the stratum or the schemes' outcomes. A persisting finding becomes a ``pair`` item ("is
+the code flagged at the old line the same issue as at the new line?"), an introduced one
+an ``introduced`` item ("did this issue already exist before the commit?").
+The sample is seeded, so rerunning it gives the same findings and the same order.
 """
 
 from __future__ import annotations
@@ -30,7 +36,12 @@
 from pathlib import Path
 from typing import Any
 
+import codeguard.rules  # noqa: F401  (registers the built-in rules)
+from codeguard.engine.registry import REGISTRY
+
 from .corpus import load_corpus
+from .linemap import map_lines
+from .schemes import split_lines
 
 HERE = Path(__file__).parent
 
@@ -69,15 +80,42 @@ def _git(repo: Path, *args: str) -> str:
     return done.stdout.decode("utf-8", "replace") if done.returncode == 0 else ""
 
 
-def snippet(repo: Path, commit: str, path: str, line: int, context: int = 4) -> str:
-    """Lines around *line* of *path* at *commit*, numbered, the line itself marked."""
+def snippet_lines(
+    repo: Path, commit: str, path: str, line: int, context: int = 4
+) -> list[tuple[int, str]]:
+    """``(line number, text)`` for the lines around *line* of *path* at *commit*."""
     lines = _git(repo, "show", f"{commit}:{path}").split("\n")
     lo, hi = max(1, line - context), min(len(lines), line + context)
+    return [(n, lines[n - 1].rstrip()) for n in range(lo, hi + 1)]
+
+
+def snippet(repo: Path, commit: str, path: str, line: int, context: int = 4) -> str:
+    """Lines around *line* of *path* at *commit*, numbered, the line itself marked."""
     return "\n".join(
-        f"{'>' if n == line else ' '}{n:5d}  {lines[n - 1]}" for n in range(lo, hi + 1)
+        f"{'>' if n == line else ' '}{n:5d}  {text}"
+        for n, text in snippet_lines(repo, commit, path, line, context)
     )
 
 
+def corresponding_old_line(
+    old_lines: list[str], new_lines: list[str], line: int
+) -> tuple[int, bool]:
+    """The old line at the place of new line *line*, and whether *line* itself maps to it.
+
+    Uses the ground truth's line map: if *line* maps back to an old line (unchanged or
+    edited), that line; otherwise the line after the nearest old line that maps to a new
+    line above *line* (the point where the new code was inserted).
+    """
+    back = {new: old for old, (new, _) in map_lines(old_lines, new_lines).items()}
+    if line in back:
+        return back[line], True
+    above = [n for n in back if n < line]
+    if not above:
+        return 1, False
+    anchor = max(above)
+    return min(back[anchor] + 1, max(len(old_lines), 1)), False
+
+
 def diff_hunks(repo: Path, old: str, new: str, path: str, old_path: str, line: int) -> str:
     """The hunks of the commit's diff of this file that come within 6 lines of *line*."""
     paths = [path] if path == old_path else [old_path, path]
@@ -164,6 +202,12 @@ def write_sample(
         "",
     ]
     rows = []
+    items = []
+    titles = {r.id: r.title for r in REGISTRY.all()}
+    # Neutral item ids in a seeded order unrelated to the strata.
+    order = list(range(1, len(chosen) + 1))
+    random.Random(len(chosen)).shuffle(order)  # noqa: S311  (blinding order, not security)
+    item_of = {i: f"F{position:03d}" for position, i in enumerate(order, start=1)}
     for i, (stratum, label, rec, old) in enumerate(chosen, start=1):
         repo = repos / label
         new = rec["commit"]
@@ -191,9 +235,44 @@ def write_sample(
         if rec["truth"] == "new" or rec.get("truth_kind") == "edited":
             hunks = diff_hunks(repo, old, new, path, old_path, rec["line"])
             md += ["Diff near the line:", "", "```diff", hunks, "```", ""]
+        old_line = rec.get("old_line")
+        if old_line:
+            before_line, before_mapped = old_line, True
+        else:
+            # An introduced finding: show the old code at the same place, so a rater can
+            # see whether the issue was already there.
+            old_text = split_lines(_git(repo, "show", f"{old}:{old_path}"))
+            new_text = split_lines(_git(repo, "show", f"{new}:{path}"))
+            before_line, before_mapped = corresponding_old_line(old_text, new_text, rec["line"])
+        items.append(
+            {
+                "item": item_of[i],
+                "kind": "pair" if rec["truth"] == "known" else "introduced",
+                "repository": label,
+                "commit_url": url,
+                "rule": rec["rule"],
+                "rule_title": titles.get(rec["rule"], ""),
+                "path": path,
+                "old_path": old_path,
+                "old_line": old_line,
+                "line": rec["line"],
+                "before": snippet_lines(
+                    repo, old, old_path, before_line, context=4 if old_line else 6
+                ),
+                "before_line": before_line,
+                # True when the flagged line itself was already there before the commit.
+                "before_mapped": before_mapped,
+                "after": snippet_lines(repo, new, path, rec["line"]),
+                "diff": "\n".join(
+                    row.rstrip()
+                    for row in diff_hunks(repo, old, new, path, old_path, rec["line"]).split("\n")
+                ),
+            }
+        )
         rows.append(
             {
                 "id": i,
+                "item": item_of[i],
                 "stratum": stratum,
                 "repository": label,
                 "commit": new,
@@ -210,6 +289,8 @@ def write_sample(
     # Quoted source can end lines in spaces; the repository's hooks strip them.
     text = "\n".join(row.rstrip() for row in "\n".join(md).split("\n"))
     (out / "sample.md").write_text(text.rstrip("\n") + "\n", encoding="utf-8")
+    items.sort(key=lambda it: str(it["item"]))
+    (out / "items.json").write_text(json.dumps(items, indent=1) + "\n", encoding="utf-8")
     with (out / "sample.csv").open("w", newline="", encoding="utf-8") as f:
         w = csv.DictWriter(f, fieldnames=list(rows[0]))
         w.writeheader()
diff --git a/research/finding_identity/paper/claims.md b/research/finding_identity/paper/claims.md
index a23fe0e..6ae718a 100644
--- a/research/finding_identity/paper/claims.md
+++ b/research/finding_identity/paper/claims.md
@@ -47,7 +47,7 @@ commit pairs per repository, replayed on 2026-10-17.
 | C8 | Edited lines are where every scheme fails | false-new on the 142 edited-line findings: `line_text` 100, `github` 87.3, `codeguard` 74.6, `sonar` 63.4, `bandit` 23.9 (Bandit ignores location and code) | `pooled.csv`, `false_new_edited` |
 | C9 | **Set membership hides new findings** | Bandit's baseline on Bandit findings without B101: 29.2 (20.1–40.9) hidden, 320 of 1,097; with B101: 51.2 (42.5–65.2), 6,670/13,024; on CodeGuard findings: 20.0 (14.1–28.6), 394/1,974 | `table_rq1.tex`, `numbers.md` |
 | C9b | It is not a test-fixture effect | without B101, outside test code: 36.3% of 273 introduced findings in 22 repositories hidden (in test code: 26.8% of 824). Other schemes outside test code: `github` 1.8, `codeguard` 2.9, `sonar` 5.9. No interval: a sensitivity check (see note C) | note C |
-| C10 | Every other scheme hides far fewer | on Bandit findings without B101: `line` 1.9, `codeguard` 2.5, `github` 3.3, `sonar` 4.5, `line_text` 6.0; on CodeGuard findings 0.8–1.9 | `table_rq1.tex` |
+| C10 | Every other scheme hides far fewer | on Bandit findings without B101: `line` 1.9, `codeguard` 2.5, `github` 3.3, `sonar` 4.5, `line_text` 6.0; on CodeGuard findings 0.8–1.9. **Upper bounds**: see G4 | `table_rq1.tex` |
 | C11 | Schemes that survive more edits collide more | collision rate, CodeGuard findings: `github` 2.1 (1.1–3.5), `line_text` 17.4 (14.0–21.3), `codeguard` 18.6 (12.9–24.8), `sonar` 20.3 (16.5–24.4), `bandit` 54.2 (44.4–62.5) | `table_rq1.tex` |
 | C12 | The pooled rate hides a skewed spread; one repository dominates `codeguard`'s rate | Ghost: `codeguard` 19.9% of 687 persisting findings (renames from `.js` to `.ts`), `sonar` 1.0, `sonar_branch` 1.7. Per-repository median of `codeguard`: 0.48 | `per_repo.csv`, `numbers.md` |
 | C13 | Findings within a repository are correlated, so per-finding intervals are too narrow | `line_text` false-new 1.89: Wilson 1.73–2.08 against cluster bootstrap 0.80–3.51 | `pooled.csv` |
@@ -56,6 +56,34 @@ Caution when pairing C11 with hidden rates: `codeguard`'s hidden rate (1.9, 0.9
 `github`'s (0.8, 0.2–1.9) have overlapping intervals, so collisions cost "tends to hide
 more", not "hides more".
 
+## Ground-truth check
+
+A manual check on 100 sampled findings; the procedure, including a flaw in its first
+round, is in `ground_truth_check/README.md`, the scores in `ground_truth_check/agreement.md`.
+
+| # | Claim | Value | Source |
+|---|---|---|---|
+| G1 | The line-diff ground truth is reliable for persisting findings | holds for 59 of 60 sampled pairs: 98.3% (Wilson 91.1–99.7); human and LLM rater agree on 59 of 60 | `agreement.md` |
+| G2 | It is weaker for introduced findings | holds for 30 of 40: 75.0% (59.8–85.8) | `agreement.md`, *Adjudicated* |
+| G3 | Its errors sit where a scheme matched an "introduced" finding | `new_but_matched`: holds for 10 of 20, 50.0% (29.9–70.1); `agree_new`: 20 of 20. The errors are findings that persisted while the line diff lost them: the flagged line was edited past the similarity threshold (an initializer, a reworded message, a declaration joined onto one line) or moved out of a removed block | `agreement.md`, `adjudicated.json` |
+| G4 | So the hidden rates of the content schemes are upper bounds, SonarQube's most | corrected hidden rate on CodeGuard findings: `sonar` 1.47 → 0.24 (range 0.07–0.66), `github` 0.81 → 0.41, `line_text` 1.17 → 0.87, `codeguard` 1.87 → 1.31. SonarQube's line-hash and code-move passes follow lines the line diff loses: 10 of the 12 sampled findings it "hid" were persisting | `agreement.md`, *Hidden rates after correcting* |
+| G5 | Bandit's hidden rate barely moves | of its 394 hidden CodeGuard findings, 339 are in `agree_new`, where the ground truth held 20 of 20; at most the other 55 could be ground-truth errors (20.0% would fall to no less than about 17%) | `agreement.md`; stratum counts from `results/corpus-v3` |
+| G6 | Threshold rules make "same finding" a question about the analyzer, not the line | three sampled complexity and nesting findings sit on an unchanged `def` line yet are new: the commit pushed the function over the limit elsewhere (verified by re-running the rule on both versions) | `adjudicated.json` (F036, F065, F076) |
+
+How to describe the check: the human rater labelled the 60 pairs and confirmed each of
+the 14 harness errors the LLM rater flagged; the 27 introduced findings the LLM rater
+confirmed as new had no human check. Report the LLM rater as an LLM. Cohen's kappa is
+not informative here (the human rater confirmed every pair, so chance agreement is
+total); report raw agreement instead.
+
+Scope: the check sampled CodeGuard findings only. Bandit's own findings (C9's 29.2%,
+C10's Bandit-findings column) were not checked, so say that their hidden rates rest on
+the same line diff without a manual check.
+
+Caution on G4: the corrected rates scale each scheme's hidden count by the share of its
+sampled matches that are truly new, from 6 to 12 sampled findings per scheme. Quote them
+as estimates with their ranges, and keep the uncorrected rates in Table II.
+
 ## RQ2: controlled changes
 
 Setup: ten transformations, each applied to one target finding in each of 40 sampled
@@ -94,8 +122,6 @@ D. **R4** counts scored `rename_function` cases by rule from
 `results/transform/*/cases.jsonl` (`target_outcomes.line_text == "false_new"`).
 
 E. **Still to do before submission.**
-- Manual check of the ground truth on a stratified sample (for Threats): a sample file
-  for labelling can be generated from `findings.jsonl`.
 - Verify every related-work reference in `outline.md` before citing it.
 - Decide whether `sonar` or `sonar_branch` is "SonarQube" in the abstract. Branch mode
   is what compares a long-lived baseline on the main branch; pull-request mode is what
diff --git a/research/finding_identity/paper/ground_truth_check/README.md b/research/finding_identity/paper/ground_truth_check/README.md
new file mode 100644
index 0000000..45e9f94
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/README.md
@@ -0,0 +1,72 @@
+# Ground-truth check
+
+A manual check of the harness's ground truth (the line diff of `linemap.py`) on a
+seeded, stratified sample of 100 CodeGuard findings from the corpus replays
+(`results/corpus-v3`), drawn by `gt_sample.py`: 20 in each of five strata.
+
+| Stratum | What the harness says | Sampled from |
+|---|---|---|
+| `edited` | persisting, on an edited line | persisting findings whose line was edited |
+| `known_but_new` | persisting, unchanged line, same path | persisting findings that SonarQube or CodeGuard report as new |
+| `new_but_matched` | introduced | introduced findings that a content scheme matched to an old one (57 in the corpus) |
+| `agree_known` | persisting | every content scheme agrees (control) |
+| `agree_new` | introduced | every content scheme agrees (control; 1,917 in the corpus) |
+
+## Files
+
+- `sample.csv`: the key. One row per finding with the stratum, the harness's answer
+  (`truth`) and the content schemes that disagree with it; `item` links to the blinded
+  items.
+- `sample.md`: the same findings for reading, with the harness's answer shown.
+- `items.json`: the blinded items the raters saw: shuffled under neutral ids, without the
+  harness's answer, the stratum or any scheme's outcome.
+- `human_labels_round1.json`: the human rater's first pass, all 100 items.
+- `agent_labels_round1.json`, `agent_labels_introduced_round2.json`: the agent rater's
+  labels, with a one-sentence reason each.
+- `human_adjudication.json`: the human rater's answers on the 14 items the agent flagged
+  as harness errors.
+- `adjudicated.json`: the final verdict per item and where it came from (`source`).
+- `agreement.md`: the scores, from `gt_agreement.py`.
+
+## How it was done
+
+1. **Round 1.** The human rater labelled all 100 items on a labelling page, and an LLM
+   agent labelled them independently, reading only `items.json`. Neither saw the other's
+   labels or the harness's answer.
+2. **A flaw in round 1.** For the 40 introduced items the page and `items.json` showed no
+   code from before the commit, only the diff, which was empty near the line for many of
+   them. Neither rater could judge whether those issues existed before. The human
+   rater's round-1 labels on introduced items are therefore not used; the 60 pair labels
+   are.
+3. **Round 2.** `items.json` now gives each introduced item the old code at the same
+   place (found with the line map). The agent relabelled the 40 introduced items from it,
+   with instructions that no longer assumed an untouched line means an issue existed.
+4. **Human confirmation.** The human rater checked each of the 14 items where the agent
+   said the harness was wrong (13 introduced items it called "existed" and one pair it
+   called "different"), seeing the agent's reason, and agreed on all 14.
+5. **Rule re-runs.** Three of those 14 (F036, F065, F076) are whole-function rules
+   (complexity, nesting) whose flagged line was unchanged. Re-running CodeGuard on the
+   file before and after the commit shows the function was not reported before: the
+   commit pushed it over the limit, so the finding is new and the harness was right.
+   Both raters had judged from an excerpt that did not show the changed lines.
+
+The 27 introduced items the agent labelled "new" in round 2 had no human check.
+
+## Result
+
+The harness's ground truth holds for 59 of 60 pairs (98.3%, Wilson 95% CI 91.1–99.7)
+and 30 of 40 introduced items (75.0%, 59.8–85.8). The errors concentrate in
+`new_but_matched`: 10 of 20 (29.9–70.1) are findings that persisted while the line diff
+lost them (a line edited past the similarity threshold, or moved out of a removed block),
+so the scheme that matched them was right. `agreement.md` has the corrected hidden rates
+per scheme.
+
+Regenerate the scores with:
+
+```bash
+G=research/finding_identity/paper/ground_truth_check
+python -m research.finding_identity.gt_agreement --human $G/human_labels_round1.json \
+    --human-kind pair --agent $G/agent_labels_round1.json \
+    --agent $G/agent_labels_introduced_round2.json --adjudicated $G/adjudicated.json \
+    --results research/finding_identity/results/corpus-v3
+```
diff --git a/research/finding_identity/paper/ground_truth_check/adjudicated.json b/research/finding_identity/paper/ground_truth_check/adjudicated.json
new file mode 100644
index 0000000..721fd33
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/adjudicated.json
@@ -0,0 +1,402 @@
+{
+ "F001": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F002": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F003": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F004": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F005": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F006": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F007": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F008": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F009": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F010": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F011": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F012": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F013": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F014": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F015": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F016": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F017": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F018": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F019": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F020": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F021": {
+  "source": "human confirmed the agent rater",
+  "verdict": "different"
+ },
+ "F022": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F023": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F024": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F025": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F026": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F027": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F028": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F029": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F030": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F031": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F032": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F033": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F034": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F035": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F036": {
+  "source": "rule re-run: createUser() reaches cyclomatic complexity 16 (limit 15) only after the commit; CodeGuard did not report it before",
+  "verdict": "new"
+ },
+ "F037": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F038": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F039": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F040": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F041": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F042": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F043": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F044": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F045": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F046": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F047": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F048": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F049": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F050": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F051": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F052": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F053": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F054": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F055": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F056": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F057": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F058": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F059": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F060": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F061": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F062": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F063": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F064": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F065": {
+  "source": "rule re-run: the test function reaches cyclomatic complexity 18 (limit 15) only after the commit; CodeGuard did not report it before",
+  "verdict": "new"
+ },
+ "F066": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F067": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F068": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F069": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F070": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F071": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F072": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F073": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F074": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F075": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F076": {
+  "source": "rule re-run: raise_for_response() reaches nesting depth 6 (limit 5) only after the commit; CodeGuard did not report it before",
+  "verdict": "new"
+ },
+ "F077": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F078": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F079": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F080": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F081": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F082": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F083": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F084": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F085": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F086": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F087": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F088": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F089": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F090": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F091": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F092": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F093": {
+  "source": "human confirmed the agent rater",
+  "verdict": "existed"
+ },
+ "F094": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F095": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F096": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F097": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ },
+ "F098": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F099": {
+  "source": "agent rater only (round 2)",
+  "verdict": "new"
+ },
+ "F100": {
+  "source": "human and agent rater agree",
+  "verdict": "same"
+ }
+}
diff --git a/research/finding_identity/paper/ground_truth_check/agent_labels_introduced_round2.json b/research/finding_identity/paper/ground_truth_check/agent_labels_introduced_round2.json
new file mode 100644
index 0000000..3fbc2d6
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/agent_labels_introduced_round2.json
@@ -0,0 +1,162 @@
+{
+ "F001": {
+  "reason": "The flagged await-in-loop is in a newly added test; the older test's loop is a separate, still-present occurrence.",
+  "verdict": "new"
+ },
+ "F007": {
+  "reason": "The loose comparison is in a newly added nested-row fetch callback that did not exist before.",
+  "verdict": "new"
+ },
+ "F008": {
+  "reason": "The file is newly added, so the await-in-loop retry code is new.",
+  "verdict": "new"
+ },
+ "F014": {
+  "reason": "'var sign' is a newly added declaration; the old block only declared 'var diff'.",
+  "verdict": "new"
+ },
+ "F015": {
+  "reason": "The MOCK_PASS meetingPassword is in a test block added where the old file had only a comment.",
+  "verdict": "new"
+ },
+ "F020": {
+  "reason": "'var loc' was already a var declaration; only its initializer changed.",
+  "verdict": "existed"
+ },
+ "F024": {
+  "reason": "The credentials line is in a newly added _get method; the existing _post copy remains separately.",
+  "verdict": "new"
+ },
+ "F027": {
+  "reason": "The f-string DROP TRIGGER execute is in a newly added test class.",
+  "verdict": "new"
+ },
+ "F028": {
+  "reason": "The same errors.password string assignment existed before, only reworded and joined onto one line.",
+  "verdict": "existed"
+ },
+ "F035": {
+  "reason": "The collectionType == \"REST\" ternary for root collections existed before and was only restructured.",
+  "verdict": "existed"
+ },
+ "F036": {
+  "reason": "The createUser signature is unchanged, there is no diff near it and line numbers are identical, so nothing shows the complexity changed.",
+  "verdict": "existed"
+ },
+ "F041": {
+  "reason": "'var card' is in the rewritten updatePermissions done-callback, which is new logic built around byNodegroup.",
+  "verdict": "new"
+ },
+ "F042": {
+  "reason": "The file is newly added, so the f-string DROP TRIGGER statements appear for the first time.",
+  "verdict": "new"
+ },
+ "F049": {
+  "reason": "The same await inside the for loop existed before, just inside the removed withChildren block (re-indented).",
+  "verdict": "existed"
+ },
+ "F051": {
+  "reason": "The file is newly added, so the innerHTML template assignment is new.",
+  "verdict": "new"
+ },
+ "F052": {
+  "reason": "'var Tokenizer' is part of the newly added select2 v4 data-adapter code.",
+  "verdict": "new"
+ },
+ "F054": {
+  "reason": "The password tuple from create_non_staff_user is in a newly added test class.",
+  "verdict": "new"
+ },
+ "F056": {
+  "reason": "The file is newly added, so the await nextTick() in the loop is new.",
+  "verdict": "new"
+ },
+ "F058": {
+  "reason": "'var loc' was already a var declaration; only its initializer changed.",
+  "verdict": "existed"
+ },
+ "F059": {
+  "reason": "The await personRepository.update call was already inside the same loop, only moved out of an if block.",
+  "verdict": "existed"
+ },
+ "F065": {
+  "reason": "The added lines are straight-line awaits with no branches, so the complexity condition must already have held.",
+  "verdict": "existed"
+ },
+ "F067": {
+  "reason": "The await readJson inside the for loop existed before; it was only reformatted with a type parameter.",
+  "verdict": "existed"
+ },
+ "F069": {
+  "reason": "'var siteLanguage' is a newly added declaration.",
+  "verdict": "new"
+ },
+ "F070": {
+  "reason": "The create_key call is in a newly added test method.",
+  "verdict": "new"
+ },
+ "F072": {
+  "reason": "The same var declaration list existed before, only merged onto one line.",
+  "verdict": "existed"
+ },
+ "F073": {
+  "reason": "The localCollections ternary with == is a new comparison; the old one in runDispatchWithOutSyncing is still present.",
+  "verdict": "new"
+ },
+ "F074": {
+  "reason": "The file is newly added, so the await axios.post in the loop is new.",
+  "verdict": "new"
+ },
+ "F076": {
+  "reason": "raise_for_response is unchanged with no diff nearby, so its nesting depth predates the commit.",
+  "verdict": "existed"
+ },
+ "F077": {
+  "reason": "'var config' is new; the old line 7 called selectize directly with no var declaration.",
+  "verdict": "new"
+ },
+ "F078": {
+  "reason": "The file is a newly added translation file.",
+  "verdict": "new"
+ },
+ "F081": {
+  "reason": "The 'starfleet' == comparison is a newly added branch; the azure comparison it displaced still exists below.",
+  "verdict": "new"
+ },
+ "F083": {
+  "reason": "The file is newly added, so preview_command and its complexity are new.",
+  "verdict": "new"
+ },
+ "F086": {
+  "reason": "The file is newly added, so the await inside the loop is new.",
+  "verdict": "new"
+ },
+ "F092": {
+  "reason": "The admin seed user with the hardcoded password looks relocated: about 247 lines were removed above it and the block reads as existing seed code, although the old copy is not shown.",
+  "verdict": "existed"
+ },
+ "F093": {
+  "reason": "The same password-message assertion existed before, only reworded.",
+  "verdict": "existed"
+ },
+ "F094": {
+  "reason": "start_wasm_invocation, with its long parameter list, is a newly added function.",
+  "verdict": "new"
+ },
+ "F095": {
+  "reason": "'var self = this;' is a newly added line.",
+  "verdict": "new"
+ },
+ "F096": {
+  "reason": "The mock access/refresh tokens are in a newly added office365 test.",
+  "verdict": "new"
+ },
+ "F098": {
+  "reason": "'var perms' is in the newly rewritten updatePermissions callback.",
+  "verdict": "new"
+ },
+ "F099": {
+  "reason": "'var lastSyncedCardSelection' is a newly added declaration.",
+  "verdict": "new"
+ }
+}
diff --git a/research/finding_identity/paper/ground_truth_check/agent_labels_round1.json b/research/finding_identity/paper/ground_truth_check/agent_labels_round1.json
new file mode 100644
index 0000000..f09548e
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/agent_labels_round1.json
@@ -0,0 +1,402 @@
+{
+ "F001": {
+  "verdict": "new",
+  "reason": "The await-in-loop line is a + line in a newly added test."
+ },
+ "F002": {
+  "verdict": "same",
+  "reason": "Same function definition, only shifted down; no diff near it."
+ },
+ "F003": {
+  "verdict": "same",
+  "reason": "Identical += line, only shifted; no diff near it."
+ },
+ "F004": {
+  "verdict": "same",
+  "reason": "Same referrer redirect moved into a new inner function."
+ },
+ "F005": {
+  "verdict": "same",
+  "reason": "Same loose-equality condition line, edited only in the role comparison."
+ },
+ "F006": {
+  "verdict": "same",
+  "reason": "Same var self in the revert method, function shifted by the commit."
+ },
+ "F007": {
+  "verdict": "new",
+  "reason": "The loose comparison is inside a large block of + lines adding nested-row loading."
+ },
+ "F008": {
+  "verdict": "new",
+  "reason": "The whole file is added by this commit."
+ },
+ "F009": {
+  "verdict": "same",
+  "reason": "Same open(temp_filepath) write, re-indented into a try block."
+ },
+ "F010": {
+  "verdict": "same",
+  "reason": "Identical empty catch, only shifted; no diff near it."
+ },
+ "F011": {
+  "verdict": "same",
+  "reason": "Same function at the same line, unchanged."
+ },
+ "F012": {
+  "verdict": "same",
+  "reason": "The after-filter awaited count checks in the loop were collapsed into one awaited call replacing the flagged line."
+ },
+ "F013": {
+  "verdict": "same",
+  "reason": "Same == comparison on the not_found error, file moved and statement rewritten as an if."
+ },
+ "F014": {
+  "verdict": "new",
+  "reason": "var sign is a + line added in the new rounding logic."
+ },
+ "F015": {
+  "verdict": "new",
+  "reason": "The MOCK_PASS line is within a block of + lines adding a new test."
+ },
+ "F016": {
+  "verdict": "same",
+  "reason": "Same var me line at the same position, unchanged."
+ },
+ "F017": {
+  "verdict": "same",
+  "reason": "Same var i line, only reformatted."
+ },
+ "F018": {
+  "verdict": "same",
+  "reason": "Same function definition, only shifted."
+ },
+ "F019": {
+  "verdict": "same",
+  "reason": "Same method definition, shifted by one line."
+ },
+ "F020": {
+  "verdict": "existed",
+  "reason": "The var loc declaration existed before; only its initializer was edited."
+ },
+ "F021": {
+  "verdict": "different",
+  "reason": "The old per-test document.body.innerHTML setup was replaced by a new shared helper writing to a created div."
+ },
+ "F022": {
+  "verdict": "same",
+  "reason": "Same method definition, only shifted."
+ },
+ "F023": {
+  "verdict": "same",
+  "reason": "Same feed function; only its signature lost a parameter."
+ },
+ "F024": {
+  "verdict": "new",
+  "reason": "The credentials unpacking is in a newly added _get method (+ lines), distinct from the existing _post occurrence."
+ },
+ "F025": {
+  "verdict": "same",
+  "reason": "Same hardcoded test password constant; only its value changed."
+ },
+ "F026": {
+  "verdict": "same",
+  "reason": "Same new_secret literal, shifted by one line."
+ },
+ "F027": {
+  "verdict": "new",
+  "reason": "The f-string execute is in a newly added test class."
+ },
+ "F028": {
+  "verdict": "existed",
+  "reason": "The errors.password message assignment existed before, only reworded and joined onto one line."
+ },
+ "F029": {
+  "verdict": "same",
+  "reason": "Same create_key line, shifted."
+ },
+ "F030": {
+  "verdict": "same",
+  "reason": "Same var geoJSONString line, shifted."
+ },
+ "F031": {
+  "verdict": "same",
+  "reason": "Same var title line at the same position."
+ },
+ "F032": {
+  "verdict": "same",
+  "reason": "Same var parts line, shifted by one."
+ },
+ "F033": {
+  "verdict": "same",
+  "reason": "Same hardcoded test password, shifted."
+ },
+ "F034": {
+  "verdict": "same",
+  "reason": "Same test function definition at the same line."
+ },
+ "F035": {
+  "verdict": "existed",
+  "reason": "The collection-branch collectionType == \"REST\" ternary was carried over from the moved file's rewritten subscription handler, which already had the same REST/GraphQL dispatch."
+ },
+ "F036": {
+  "verdict": "existed",
+  "reason": "No diff near the createUser definition, so the function existed unchanged at this position."
+ },
+ "F037": {
+  "verdict": "same",
+  "reason": "Same tokenNamePrefix literal in the same test, shifted."
+ },
+ "F038": {
+  "verdict": "same",
+  "reason": "Same hardcoded test password, shifted."
+ },
+ "F039": {
+  "verdict": "same",
+  "reason": "Same except/pass at the same line, unchanged."
+ },
+ "F040": {
+  "verdict": "same",
+  "reason": "The Manufacture else-if comparison is an unchanged context line, shifted by one."
+ },
+ "F041": {
+  "verdict": "new",
+  "reason": "The var card lookup is within the rewritten updatePermissions + lines."
+ },
+ "F042": {
+  "verdict": "new",
+  "reason": "The whole file is added by this commit."
+ },
+ "F043": {
+  "verdict": "same",
+  "reason": "Same data != \"null\" check, shifted."
+ },
+ "F044": {
+  "verdict": "same",
+  "reason": "Same role comparison in the selection loop, edited to normalise nulls."
+ },
+ "F045": {
+  "verdict": "same",
+  "reason": "Same merge of req.body into the checklist item, shifted by one."
+ },
+ "F046": {
+  "verdict": "same",
+  "reason": "Same status != COMPLETE ternary, shifted."
+ },
+ "F047": {
+  "verdict": "same",
+  "reason": "Same purchaseHourglass function; only a parameter was removed."
+ },
+ "F048": {
+  "verdict": "same",
+  "reason": "Same hardcoded admin password at the same line."
+ },
+ "F049": {
+  "verdict": "existed",
+  "reason": "The awaited recursive export in the loop was moved out of the removed withChildren block, de-indented."
+ },
+ "F050": {
+  "verdict": "same",
+  "reason": "Same f-string INSERT in the test, shifted."
+ },
+ "F051": {
+  "verdict": "new",
+  "reason": "The whole file is added by this commit."
+ },
+ "F052": {
+  "verdict": "new",
+  "reason": "var Tokenizer is part of the new select2 data-adapter code added by the commit."
+ },
+ "F053": {
+  "verdict": "same",
+  "reason": "Same var declaration of the tags widget, only renamed for tomselect."
+ },
+ "F054": {
+  "verdict": "new",
+  "reason": "The line is in a newly added test class."
+ },
+ "F055": {
+  "verdict": "same",
+  "reason": "Same awaited migration.migrate() in the migrations loop, carried into the rewritten runMigrations."
+ },
+ "F056": {
+  "verdict": "new",
+  "reason": "The whole test file is added by this commit."
+ },
+ "F057": {
+  "verdict": "same",
+  "reason": "Same MOCK_PASSWORD literal, shifted."
+ },
+ "F058": {
+  "verdict": "existed",
+  "reason": "The var loc declaration existed before; only its initializer was edited."
+ },
+ "F059": {
+  "verdict": "existed",
+  "reason": "The awaited update in the loop was moved out of the removed if-block, de-indented."
+ },
+ "F060": {
+  "verdict": "same",
+  "reason": "Same innerHTML copy of the document container; only the element variable was renamed."
+ },
+ "F061": {
+  "verdict": "same",
+  "reason": "Same MOCK_PASS literal in the same test, shifted."
+ },
+ "F062": {
+  "verdict": "same",
+  "reason": "Same hardcoded test password, shifted."
+ },
+ "F063": {
+  "verdict": "same",
+  "reason": "Same loose comparison against node.nodeid; only the loop variable was renamed."
+ },
+ "F064": {
+  "verdict": "same",
+  "reason": "Same MOCK_PASS literal just after the rewritten hunk, shifted by the same offset as neighbouring lines."
+ },
+ "F065": {
+  "verdict": "existed",
+  "reason": "The flagged function definition is an unchanged context line; the commit only added straight-line setup calls to an existing function."
+ },
+ "F066": {
+  "verdict": "same",
+  "reason": "Same MOCK_PASS literal, shifted."
+ },
+ "F067": {
+  "verdict": "existed",
+  "reason": "The awaited readJson in the loop existed before; the line was only edited to add a type parameter."
+ },
+ "F068": {
+  "verdict": "same",
+  "reason": "Same password literal in an unchanged test, shifted by a new test inserted above."
+ },
+ "F069": {
+  "verdict": "new",
+  "reason": "var siteLanguage is a + line added by the commit."
+ },
+ "F070": {
+  "verdict": "new",
+  "reason": "The create_key line is in a newly added test."
+ },
+ "F071": {
+  "verdict": "same",
+  "reason": "Same var selectedText line, shifted."
+ },
+ "F072": {
+  "verdict": "existed",
+  "reason": "The same var declaration list existed before, only joined onto one line."
+ },
+ "F073": {
+  "verdict": "new",
+  "reason": "The localCollections ternary with == is a newly added + line; the pre-existing comparison remains separately below."
+ },
+ "F074": {
+  "verdict": "new",
+  "reason": "The whole file is added by this commit."
+ },
+ "F075": {
+  "verdict": "same",
+  "reason": "Same f-string INSERT, shifted."
+ },
+ "F076": {
+  "verdict": "existed",
+  "reason": "No diff near the flagged method, so it existed unchanged."
+ },
+ "F077": {
+  "verdict": "new",
+  "reason": "var config is a + line added for the TomSelect setup."
+ },
+ "F078": {
+  "verdict": "new",
+  "reason": "The whole translation file is added by this commit."
+ },
+ "F079": {
+  "verdict": "same",
+  "reason": "Same f-string INSERT, shifted."
+ },
+ "F080": {
+  "verdict": "same",
+  "reason": "Same MOCK_PASS literal, shifted."
+ },
+ "F081": {
+  "verdict": "new",
+  "reason": "The starfleet comparison is a newly added branch; the old azure comparison moved to the following else-if."
+ },
+ "F082": {
+  "verdict": "same",
+  "reason": "Same var siteLanguage in loadCannedResponses, shifted."
+ },
+ "F083": {
+  "verdict": "new",
+  "reason": "The whole file is added by this commit."
+ },
+ "F084": {
+  "verdict": "same",
+  "reason": "Same purchase function; only a parameter was removed."
+ },
+ "F085": {
+  "verdict": "same",
+  "reason": "Same MOCK_PASSWORD literal, shifted."
+ },
+ "F086": {
+  "verdict": "new",
+  "reason": "The whole file is added by this commit."
+ },
+ "F087": {
+  "verdict": "same",
+  "reason": "Same awaited exists() check in the loop, edited only with a type cast."
+ },
+ "F088": {
+  "verdict": "same",
+  "reason": "Same awaited call in the loop; only an argument was added."
+ },
+ "F089": {
+  "verdict": "same",
+  "reason": "Same var matchingCard line, shifted."
+ },
+ "F090": {
+  "verdict": "same",
+  "reason": "Same handleNoShowFee declaration, only whitespace changed."
+ },
+ "F091": {
+  "verdict": "same",
+  "reason": "Same test method, shifted."
+ },
+ "F092": {
+  "verdict": "unclear",
+  "reason": "The admin seed block is shown as + lines, but the hunk header implies ~250 lines were removed earlier and the excerpt cannot show whether this block was moved from there."
+ },
+ "F093": {
+  "verdict": "existed",
+  "reason": "The expected password message existed before at the same place; only its text was edited."
+ },
+ "F094": {
+  "verdict": "new",
+  "reason": "The function is in a large block of + lines added by the commit."
+ },
+ "F095": {
+  "verdict": "new",
+  "reason": "var self = this is a + line added in initialize."
+ },
+ "F096": {
+  "verdict": "new",
+  "reason": "The credential literal is in a newly added test."
+ },
+ "F097": {
+  "verdict": "same",
+  "reason": "Same MOCK_PASS literal, shifted."
+ },
+ "F098": {
+  "verdict": "new",
+  "reason": "var perms is part of the rewritten permission-loading + lines."
+ },
+ "F099": {
+  "verdict": "new",
+  "reason": "var lastSyncedCardSelection is a + line added by the commit."
+ },
+ "F100": {
+  "verdict": "same",
+  "reason": "Same function; its signature gained an optional parameter."
+ }
+}
diff --git a/research/finding_identity/paper/ground_truth_check/agreement.md b/research/finding_identity/paper/ground_truth_check/agreement.md
new file mode 100644
index 0000000..9ce93ae
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/agreement.md
@@ -0,0 +1,92 @@
+# Ground-truth check: results
+
+Generated by `research/finding_identity/gt_agreement.py`. *Holds* is the share of
+decided items (unclear left out) where the rater confirms the harness's truth, with
+a Wilson 95% interval.
+
+## Human rater
+
+60 of 100 items labelled.
+
+| kind | confirms | contradicts | unclear | holds | 95% CI |
+|---|---:|---:|---:|---:|---|
+| introduced | 0 | 0 | 40 | n/a | n/a |
+| pair | 60 | 0 | 0 | 100.0% | [94.0, 100.0] |
+| all | 60 | 0 | 40 | 100.0% | [94.0, 100.0] |
+
+| stratum | confirms | contradicts | unclear | holds | 95% CI |
+|---|---:|---:|---:|---:|---|
+| agree_known | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| agree_new | 0 | 0 | 20 | n/a | n/a |
+| edited | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| known_but_new | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| new_but_matched | 0 | 0 | 20 | n/a | n/a |
+| all | 60 | 0 | 40 | 100.0% | [94.0, 100.0] |
+
+## Agent rater
+
+100 of 100 items labelled.
+
+| kind | confirms | contradicts | unclear | holds | 95% CI |
+|---|---:|---:|---:|---:|---|
+| introduced | 27 | 13 | 0 | 67.5% | [52.0, 79.9] |
+| pair | 59 | 1 | 0 | 98.3% | [91.1, 99.7] |
+| all | 86 | 14 | 0 | 86.0% | [77.9, 91.5] |
+
+| stratum | confirms | contradicts | unclear | holds | 95% CI |
+|---|---:|---:|---:|---:|---|
+| agree_known | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| agree_new | 17 | 3 | 0 | 85.0% | [64.0, 94.8] |
+| edited | 19 | 1 | 0 | 95.0% | [76.4, 99.1] |
+| known_but_new | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| new_but_matched | 10 | 10 | 0 | 50.0% | [29.9, 70.1] |
+| all | 86 | 14 | 0 | 86.0% | [77.9, 91.5] |
+
+## Agreement between Human rater and Agent rater
+
+On the 60 items both labelled (confirms / contradicts / unclear):
+59 agree (98.3%), Cohen's kappa 0.00.
+
+Items to adjudicate: F021.
+
+## Adjudicated
+
+100 of 100 items labelled.
+
+| kind | confirms | contradicts | unclear | holds | 95% CI |
+|---|---:|---:|---:|---:|---|
+| introduced | 30 | 10 | 0 | 75.0% | [59.8, 85.8] |
+| pair | 59 | 1 | 0 | 98.3% | [91.1, 99.7] |
+| all | 89 | 11 | 0 | 89.0% | [81.4, 93.7] |
+
+| stratum | confirms | contradicts | unclear | holds | 95% CI |
+|---|---:|---:|---:|---:|---|
+| agree_known | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| agree_new | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| edited | 19 | 1 | 0 | 95.0% | [76.4, 99.1] |
+| known_but_new | 20 | 0 | 0 | 100.0% | [83.9, 100.0] |
+| new_but_matched | 10 | 10 | 0 | 50.0% | [29.9, 70.1] |
+| all | 89 | 11 | 0 | 89.0% | [81.4, 93.7] |
+
+Sources of the adjudicated verdicts:
+
+- 59: human and agent rater agree
+- 27: agent rater only (round 2)
+- 11: human confirmed the agent rater
+- 1: rule re-run: createUser() reaches cyclomatic complexity 16 (limit 15) only after the commit; CodeGuard did not report it before
+- 1: rule re-run: the test function reaches cyclomatic complexity 18 (limit 15) only after the commit; CodeGuard did not report it before
+- 1: rule re-run: raise_for_response() reaches nesting depth 6 (limit 5) only after the commit; CodeGuard did not report it before
+
+## Hidden rates after correcting the ground truth
+
+From `research/finding_identity/results/corpus-v3`: 1,974 introduced findings. *Matched, sampled*: the
+scheme's hidden findings among the sampled `new_but_matched` items; *truly new*:
+those the adjudication confirms as new. The corrected rate scales the hidden
+count by that share (range: its Wilson 95% interval).
+
+| scheme | hidden | matched, sampled | truly new | corrected hidden | range |
+|---|---:|---:|---:|---:|---|
+| `line_text` | 1.17% (23) | 8 | 6 | 0.87% | [0.48, 1.08] |
+| `github` | 0.81% (16) | 6 | 3 | 0.41% | [0.15, 0.66] |
+| `codeguard` | 1.87% (37) | 10 | 7 | 1.31% | [0.74, 1.67] |
+| `sonar` | 1.47% (29) | 12 | 2 | 0.24% | [0.07, 0.66] |
diff --git a/research/finding_identity/paper/ground_truth_check/human_adjudication.json b/research/finding_identity/paper/ground_truth_check/human_adjudication.json
new file mode 100644
index 0000000..0dad20a
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/human_adjudication.json
@@ -0,0 +1,72 @@
+{
+ "F020": {
+  "at": "2026-10-18T08:07:24.387Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F021": {
+  "at": "2026-10-18T08:13:34.507Z",
+  "note": "",
+  "verdict": "different"
+ },
+ "F028": {
+  "at": "2026-10-18T08:13:42.932Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F035": {
+  "at": "2026-10-18T08:13:52.453Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F036": {
+  "at": "2026-10-18T08:13:57.676Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F049": {
+  "at": "2026-10-18T08:14:01.349Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F058": {
+  "at": "2026-10-18T08:14:06.458Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F059": {
+  "at": "2026-10-18T08:14:15.091Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F065": {
+  "at": "2026-10-18T08:14:19.344Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F067": {
+  "at": "2026-10-18T08:14:23.883Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F072": {
+  "at": "2026-10-18T08:14:27.899Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F076": {
+  "at": "2026-10-18T08:14:44.112Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F092": {
+  "at": "2026-10-18T08:14:50.120Z",
+  "note": "",
+  "verdict": "existed"
+ },
+ "F093": {
+  "at": "2026-10-18T08:14:54.128Z",
+  "note": "",
+  "verdict": "existed"
+ }
+}
diff --git a/research/finding_identity/paper/ground_truth_check/human_labels_round1.json b/research/finding_identity/paper/ground_truth_check/human_labels_round1.json
new file mode 100644
index 0000000..737700a
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/human_labels_round1.json
@@ -0,0 +1,502 @@
+{
+ "F001": {
+  "at": "2026-10-18T07:49:38.103Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F002": {
+  "at": "2026-10-18T07:49:49.965Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F003": {
+  "at": "2026-10-18T07:49:58.592Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F004": {
+  "at": "2026-10-18T07:50:04.375Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F005": {
+  "at": "2026-10-18T07:50:14.428Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F006": {
+  "at": "2026-10-18T07:50:17.342Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F007": {
+  "at": "2026-10-18T07:50:21.309Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F008": {
+  "at": "2026-10-18T07:50:24.190Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F009": {
+  "at": "2026-10-18T07:50:27.072Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F010": {
+  "at": "2026-10-18T07:50:30.324Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F011": {
+  "at": "2026-10-18T07:50:45.302Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F012": {
+  "at": "2026-10-18T07:59:20.216Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F013": {
+  "at": "2026-10-18T07:59:52.453Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F014": {
+  "at": "2026-10-18T07:51:02.148Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F015": {
+  "at": "2026-10-18T07:51:05.824Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F016": {
+  "at": "2026-10-18T07:51:16.383Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F017": {
+  "at": "2026-10-18T07:51:21.067Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F018": {
+  "at": "2026-10-18T07:51:26.705Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F019": {
+  "at": "2026-10-18T07:51:30.399Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F020": {
+  "at": "2026-10-18T07:51:32.718Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F021": {
+  "at": "2026-10-18T08:00:22.268Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F022": {
+  "at": "2026-10-18T07:51:38.505Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F023": {
+  "at": "2026-10-18T08:00:00.319Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F024": {
+  "at": "2026-10-18T07:51:44.346Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F025": {
+  "at": "2026-10-18T07:58:57.385Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F026": {
+  "at": "2026-10-18T07:52:22.931Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F027": {
+  "at": "2026-10-18T07:52:25.543Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F028": {
+  "at": "2026-10-18T07:52:29.402Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F029": {
+  "at": "2026-10-18T07:52:34.048Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F030": {
+  "at": "2026-10-18T07:55:10.450Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F031": {
+  "at": "2026-10-18T07:55:13.225Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F032": {
+  "at": "2026-10-18T07:55:16.876Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F033": {
+  "at": "2026-10-18T07:55:20.111Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F034": {
+  "at": "2026-10-18T07:55:22.852Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F035": {
+  "at": "2026-10-18T07:55:25.612Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F036": {
+  "at": "2026-10-18T07:55:28.515Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F037": {
+  "at": "2026-10-18T07:55:31.484Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F038": {
+  "at": "2026-10-18T07:55:34.026Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F039": {
+  "at": "2026-10-18T07:55:36.322Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F040": {
+  "at": "2026-10-18T07:55:38.244Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F041": {
+  "at": "2026-10-18T07:55:40.240Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F042": {
+  "at": "2026-10-18T07:55:43.995Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F043": {
+  "at": "2026-10-18T07:55:46.554Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F044": {
+  "at": "2026-10-18T07:59:56.234Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F045": {
+  "at": "2026-10-18T07:56:10.897Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F046": {
+  "at": "2026-10-18T07:56:15.109Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F047": {
+  "at": "2026-10-18T07:56:21.186Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F048": {
+  "at": "2026-10-18T07:56:23.266Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F049": {
+  "at": "2026-10-18T07:56:25.130Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F050": {
+  "at": "2026-10-18T07:56:28.576Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F051": {
+  "at": "2026-10-18T07:56:30.801Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F052": {
+  "at": "2026-10-18T07:56:33.433Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F053": {
+  "at": "2026-10-18T07:56:35.687Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F054": {
+  "at": "2026-10-18T07:56:37.699Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F055": {
+  "at": "2026-10-18T07:56:51.178Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F056": {
+  "at": "2026-10-18T07:56:52.930Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F057": {
+  "at": "2026-10-18T07:56:57.418Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F058": {
+  "at": "2026-10-18T07:56:59.088Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F059": {
+  "at": "2026-10-18T07:57:00.632Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F060": {
+  "at": "2026-10-18T07:57:03.925Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F061": {
+  "at": "2026-10-18T07:57:06.352Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F062": {
+  "at": "2026-10-18T07:57:09.762Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F063": {
+  "at": "2026-10-18T07:57:15.830Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F064": {
+  "at": "2026-10-18T07:57:18.197Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F065": {
+  "at": "2026-10-18T07:57:20.076Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F066": {
+  "at": "2026-10-18T07:57:23.018Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F067": {
+  "at": "2026-10-18T07:57:25.796Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F068": {
+  "at": "2026-10-18T07:57:29.469Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F069": {
+  "at": "2026-10-18T07:57:31.315Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F070": {
+  "at": "2026-10-18T07:57:35.283Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F071": {
+  "at": "2026-10-18T07:57:37.872Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F072": {
+  "at": "2026-10-18T07:57:40.101Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F073": {
+  "at": "2026-10-18T07:57:43.534Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F074": {
+  "at": "2026-10-18T07:57:46.582Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F075": {
+  "at": "2026-10-18T07:57:48.938Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F076": {
+  "at": "2026-10-18T07:57:50.569Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F077": {
+  "at": "2026-10-18T07:57:52.416Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F078": {
+  "at": "2026-10-18T07:57:54.322Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F079": {
+  "at": "2026-10-18T07:57:55.968Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F080": {
+  "at": "2026-10-18T07:57:57.323Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F081": {
+  "at": "2026-10-18T07:57:59.024Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F082": {
+  "at": "2026-10-18T07:58:00.678Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F083": {
+  "at": "2026-10-18T07:58:02.103Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F084": {
+  "at": "2026-10-18T07:58:07.685Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F085": {
+  "at": "2026-10-18T07:58:09.927Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F086": {
+  "at": "2026-10-18T07:58:17.789Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F087": {
+  "at": "2026-10-18T07:58:19.499Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F088": {
+  "at": "2026-10-18T07:58:21.445Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F089": {
+  "at": "2026-10-18T07:58:23.591Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F090": {
+  "at": "2026-10-18T07:58:25.287Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F091": {
+  "at": "2026-10-18T07:58:27.208Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F092": {
+  "at": "2026-10-18T07:58:28.498Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F093": {
+  "at": "2026-10-18T07:58:32.837Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F094": {
+  "at": "2026-10-18T07:58:37.738Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F095": {
+  "at": "2026-10-18T07:58:39.234Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F096": {
+  "at": "2026-10-18T07:58:41.648Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F097": {
+  "at": "2026-10-18T07:58:45.100Z",
+  "note": "",
+  "verdict": "same"
+ },
+ "F098": {
+  "at": "2026-10-18T07:58:47.519Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F099": {
+  "at": "2026-10-18T07:58:48.748Z",
+  "note": "",
+  "verdict": "new"
+ },
+ "F100": {
+  "at": "2026-10-18T07:58:50.869Z",
+  "note": "",
+  "verdict": "same"
+ }
+}
diff --git a/research/finding_identity/paper/ground_truth_check/items.json b/research/finding_identity/paper/ground_truth_check/items.json
new file mode 100644
index 0000000..39bb3c8
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/items.json
@@ -0,0 +1,9290 @@
+[
+ {
+  "item": "F001",
+  "kind": "introduced",
+  "repository": "ghost",
+  "commit_url": "https://github.com/TryGhost/Ghost/commit/7da91e095b2803c62bc67fe70f2c4f0d114846d9",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "tools/scripts/test/ci-path-filters.test.js",
+  "old_path": "tools/scripts/test/ci-path-filters.test.js",
+  "old_line": null,
+  "line": 69,
+  "before": [
+   [
+    51,
+    "    assert.ok(docs.includes('**/*.md'));"
+   ],
+   [
+    52,
+    "    assert.ok(docs.includes('**/*.mdx'));"
+   ],
+   [
+    53,
+    "    assert.ok(anyCode.includes('!**/*.md'));"
+   ],
+   [
+    54,
+    "    assert.ok(anyCode.includes('!**/*.mdx'));"
+   ],
+   [
+    55,
+    "    assert.ok(e2e.includes('!**/*.md'));"
+   ],
+   [
+    56,
+    "    assert.ok(e2e.includes('!**/*.mdx'));"
+   ],
+   [
+    57,
+    "  });"
+   ],
+   [
+    58,
+    ""
+   ],
+   [
+    59,
+    "  it('skips code checks and E2E for ownership and docs changes, but keeps mixed changes', async () => {"
+   ],
+   [
+    60,
+    "    for (const filterName of ['any-code', 'e2e']) {"
+   ],
+   [
+    61,
+    "      const patterns = await getFilterPatterns(filterName);"
+   ],
+   [
+    62,
+    "      const matches = (path) =>"
+   ],
+   [
+    63,
+    "        patterns.every((pattern) => picomatch(pattern, { dot: true })(path));"
+   ]
+  ],
+  "before_line": 57,
+  "before_mapped": false,
+  "after": [
+   [
+    65,
+    "    const docs = await getFilterPatterns('docs');"
+   ],
+   [
+    66,
+    "    assert.ok(docs.some((pattern) => picomatch(pattern, { dot: true })(inventory)));"
+   ],
+   [
+    67,
+    ""
+   ],
+   [
+    68,
+    "    for (const filterName of ['core', 'any-code', 'e2e']) {"
+   ],
+   [
+    69,
+    "      const patterns = await getFilterPatterns(filterName);"
+   ],
+   [
+    70,
+    "      const positives = patterns.filter((pattern) => !pattern.startsWith('!'));"
+   ],
+   [
+    71,
+    "      const exclusions = patterns.filter((pattern) => pattern.startsWith('!'));"
+   ],
+   [
+    72,
+    "      const matches = (path) =>"
+   ],
+   [
+    73,
+    "        (positives.length === 0 ||"
+   ]
+  ],
+  "diff": "@@ -56,6 +60,83 @@ describe('CI path filters', () => {\n     assert.ok(e2e.includes('!**/*.mdx'));\n   });\n\n+  it('treats the service inventory as docs and keeps code checks for mixed changes', async () => {\n+    const inventory = 'ghost/core/server/services/service-inventory.yaml';\n+    const docs = await getFilterPatterns('docs');\n+    assert.ok(docs.some((pattern) => picomatch(pattern, { dot: true })(inventory)));\n+\n+    for (const filterName of ['core', 'any-code', 'e2e']) {\n+      const patterns = await getFilterPatterns(filterName);\n+      const positives = patterns.filter((pattern) => !pattern.startsWith('!'));\n+      const exclusions = patterns.filter((pattern) => pattern.startsWith('!'));\n+      const matches = (path) =>\n+        (positives.length === 0 ||\n+          positives.some((pattern) => picomatch(pattern, { dot: true })(path))) &&\n+        exclusions.every((pattern) => picomatch(pattern, { dot: true })(path));\n+      const metadata = [inventory, 'ghost/core/server/services/README.md'];\n+\n+      assert.strictEqual(metadata.some(matches), false, filterName);\n+      for (const runtime of [\n+        'ghost/core/server/services/identity-tokens/index.ts',\n+        'ghost/core/server/services/other-metadata.yaml',\n+        '.github/workflows/ci.yml',\n+      ]) {\n+        assert.strictEqual([...metadata, runtime].some(matches), true, `${filterName}: ${runtime}`);\n+      }\n+    }\n+\n+    const anyCode = await getFilterPatterns('any-code');\n+    assert.ok(\n+      anyCode.every((pattern) =>\n+        picomatch(pattern, { dot: true })(\n+          'ghost/test/unit/server/services/service-inventory.test.ts',\n+        ),\n+      ),\n+      'Changes to the inventory validator must still run code checks',\n+    );\n+  });\n+\n... (45 more lines)"
+ },
+ {
+  "item": "F002",
+  "kind": "pair",
+  "repository": "erpnext",
+  "commit_url": "https://github.com/frappe/erpnext/commit/028a9ed1d94ce99702dd65b32ca3aede52b52006",
+  "rule": "CG-QUAL-005",
+  "rule_title": "Function takes too many parameters",
+  "path": "erpnext/stock/doctype/pick_list/pick_list.py",
+  "old_path": "erpnext/stock/doctype/pick_list/pick_list.py",
+  "old_line": 1354,
+  "line": 1451,
+  "before": [
+   [
+    1350,
+    "\titem_location_map[item_doc.item_code] = available_locations"
+   ],
+   [
+    1351,
+    "\treturn locations"
+   ],
+   [
+    1352,
+    ""
+   ],
+   [
+    1353,
+    ""
+   ],
+   [
+    1354,
+    "def get_available_item_locations("
+   ],
+   [
+    1355,
+    "\titem_code,"
+   ],
+   [
+    1356,
+    "\tfrom_warehouses,"
+   ],
+   [
+    1357,
+    "\trequired_qty,"
+   ],
+   [
+    1358,
+    "\tcompany,"
+   ]
+  ],
+  "before_line": 1354,
+  "before_mapped": true,
+  "after": [
+   [
+    1447,
+    "\titem_location_map[item_doc.item_code] = available_locations"
+   ],
+   [
+    1448,
+    "\treturn locations"
+   ],
+   [
+    1449,
+    ""
+   ],
+   [
+    1450,
+    ""
+   ],
+   [
+    1451,
+    "def get_available_item_locations("
+   ],
+   [
+    1452,
+    "\titem_code,"
+   ],
+   [
+    1453,
+    "\tfrom_warehouses,"
+   ],
+   [
+    1454,
+    "\trequired_qty,"
+   ],
+   [
+    1455,
+    "\tcompany,"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F003",
+  "kind": "pair",
+  "repository": "erpnext",
+  "commit_url": "https://github.com/frappe/erpnext/commit/750bf9d9b378fb92eab68733ae727214f3961c0a",
+  "rule": "CG-PERF-002",
+  "rule_title": "String built with += inside a loop",
+  "path": "erpnext/stock/utils.py",
+  "old_path": "erpnext/stock/utils.py",
+  "old_line": 159,
+  "line": 185,
+  "before": [
+   [
+    155,
+    "\t\t\t\t\t\tfrappe.bold(field), frappe.bold(\"Inventory Dimension\")"
+   ],
+   [
+    156,
+    "\t\t\t\t\t)"
+   ],
+   [
+    157,
+    "\t\t\t\t)"
+   ],
+   [
+    158,
+    "\t\t\targs[field] = value"
+   ],
+   [
+    159,
+    "\t\t\textra_cond += f\" and {field} = %({field})s\""
+   ],
+   [
+    160,
+    ""
+   ],
+   [
+    161,
+    "\tlast_entry = get_previous_sle(args, extra_cond=extra_cond)"
+   ],
+   [
+    162,
+    ""
+   ],
+   [
+    163,
+    "\tif with_valuation_rate:"
+   ]
+  ],
+  "before_line": 159,
+  "before_mapped": true,
+  "after": [
+   [
+    181,
+    "\t\t\t\t\t\tfrappe.bold(field), frappe.bold(\"Inventory Dimension\")"
+   ],
+   [
+    182,
+    "\t\t\t\t\t)"
+   ],
+   [
+    183,
+    "\t\t\t\t)"
+   ],
+   [
+    184,
+    "\t\t\targs[field] = value"
+   ],
+   [
+    185,
+    "\t\t\textra_cond += f\" and {field} = %({field})s\""
+   ],
+   [
+    186,
+    ""
+   ],
+   [
+    187,
+    "\tlast_entry = get_previous_sle(args, extra_cond=extra_cond)"
+   ],
+   [
+    188,
+    ""
+   ],
+   [
+    189,
+    "\tif with_valuation_rate:"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F004",
+  "kind": "pair",
+  "repository": "kiwi",
+  "commit_url": "https://github.com/kiwitcms/Kiwi/commit/362febe93063899b8c7468cf7490c26028368a5c",
+  "rule": "CG-SEC-109",
+  "rule_title": "Redirect to a URL taken from the request",
+  "path": "tcms/testplans/static/testplans/js/clone.js",
+  "old_path": "tcms/testplans/static/testplans/js/clone.js",
+  "old_line": 110,
+  "line": 112,
+  "before": [
+   [
+    106,
+    ""
+   ],
+   [
+    107,
+    "            if (newPlanIds.length === 1) {"
+   ],
+   [
+    108,
+    "                window.location.assign(`/plan/${newPlanIds[0]}/`)"
+   ],
+   [
+    109,
+    "            } else {"
+   ],
+   [
+    110,
+    "                window.location.assign(document.referrer || '/')"
+   ],
+   [
+    111,
+    "            }"
+   ],
+   [
+    112,
+    "        }"
+   ],
+   [
+    113,
+    ""
+   ],
+   [
+    114,
+    "        if (!rows.length) {"
+   ]
+  ],
+  "before_line": 110,
+  "before_mapped": true,
+  "after": [
+   [
+    108,
+    "            const redirectToClonedPlan = function () {"
+   ],
+   [
+    109,
+    "                if (isTree || newPlanIds.length === 1) {"
+   ],
+   [
+    110,
+    "                    window.location.assign(`/plan/${newPlanIds[0]}/`)"
+   ],
+   [
+    111,
+    "                } else {"
+   ],
+   [
+    112,
+    "                    window.location.assign(document.referrer || '/')"
+   ],
+   [
+    113,
+    "                }"
+   ],
+   [
+    114,
+    "            }"
+   ],
+   [
+    115,
+    ""
+   ],
+   [
+    116,
+    "            // in tree mode set the parent of every clone, which can only be"
+   ]
+  ],
+  "diff": "@@ -104,11 +105,44 @@ export function pageTestplansCloneReadyHandler () {\n                 return\n             }\n\n-            if (newPlanIds.length === 1) {\n-                window.location.assign(`/plan/${newPlanIds[0]}/`)\n-            } else {\n-                window.location.assign(document.referrer || '/')\n+            const redirectToClonedPlan = function () {\n+                if (isTree || newPlanIds.length === 1) {\n+                    window.location.assign(`/plan/${newPlanIds[0]}/`)\n+                } else {\n+                    window.location.assign(document.referrer || '/')\n+                }\n             }\n+\n+            // in tree mode set the parent of every clone, which can only be\n+            // done once all of the clones have been created.\n+            if (isTree) {\n+                let updatedCount = 0\n+\n+                const updateIsDone = function () {\n+                    updatedCount += 1\n+\n+                    if (updatedCount === rows.length) {\n+                        redirectToClonedPlan()\n+                    }\n+                }\n+\n+                rows.each(function () {\n+                    const row = $(this)\n+\n+                    jsonRPC(\n+                        'TestPlan.update',\n+                        [\n+                            clonedPlanIds[row.data('plan-id')],\n+                            { parent: clonedPlanIds[row.attr('data-parent-id')] }\n+                        ],\n+                        updateIsDone\n+                    )\n... (10 more lines)"
+ },
+ {
+  "item": "F005",
+  "kind": "pair",
+  "repository": "pgadmin",
+  "commit_url": "https://github.com/pgadmin-org/pgadmin4/commit/5f56805162c117ac1de17368ef8fdc0b07221e2c",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx",
+  "old_path": "web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx",
+  "old_line": 813,
+  "line": 872,
+  "before": [
+   [
+    809,
+    "          let existIdx = _.findIndex(qtState.connection_list, (conn)=>{"
+   ],
+   [
+    810,
+    "            conn.role= conn.role == ''? null :conn.role;"
+   ],
+   [
+    811,
+    "            return("
+   ],
+   [
+    812,
+    "              conn.sid == connectionData.sid  && conn.database_name == connectionData.database_name"
+   ],
+   [
+    813,
+    "              && conn.user == connectionData.user && conn.role == connectionData.role"
+   ],
+   [
+    814,
+    "            );"
+   ],
+   [
+    815,
+    "          });"
+   ],
+   [
+    816,
+    "          if(existIdx > -1) {"
+   ],
+   [
+    817,
+    "            reject(new Error(gettext('Connection with this configuration already present.')));"
+   ]
+  ],
+  "before_line": 813,
+  "before_mapped": true,
+  "after": [
+   [
+    868,
+    ""
+   ],
+   [
+    869,
+    "          let existIdx = _.findIndex(qtState.connection_list, (conn)=>{"
+   ],
+   [
+    870,
+    "            return("
+   ],
+   [
+    871,
+    "              conn.sid == connectionData.sid  && conn.database_name == connectionData.database_name"
+   ],
+   [
+    872,
+    "              && conn.user == connectionData.user && (conn.role || null) == (connectionData.role || null)"
+   ],
+   [
+    873,
+    "            );"
+   ],
+   [
+    874,
+    "          });"
+   ],
+   [
+    875,
+    "          if(existIdx > -1) {"
+   ],
+   [
+    876,
+    "            reject(new Error(gettext('Connection with this configuration already present.')));"
+   ]
+  ],
+  "diff": "@@ -807,10 +867,9 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN\n           };\n\n           let existIdx = _.findIndex(qtState.connection_list, (conn)=>{\n-            conn.role= conn.role == ''? null :conn.role;\n             return(\n               conn.sid == connectionData.sid  && conn.database_name == connectionData.database_name\n-              && conn.user == connectionData.user && conn.role == connectionData.role\n+              && conn.user == connectionData.user && (conn.role || null) == (connectionData.role || null)\n             );\n           });\n           if(existIdx > -1) {\n@@ -818,11 +877,12 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN\n             return;\n           }\n           updateQueryToolConnection(connectionData, true)\n-            .catch((err)=>{\n-              reject(err instanceof Error ? err : Error(gettext('Something went wrong')));\n-            }).then(()=>{\n+            .then(()=>{\n               resolve();\n               onClose();\n+            })\n+            .catch((err)=>{\n+              reject(err instanceof Error ? err : Error(gettext('Something went wrong')));\n             });\n         });\n       }}"
+ },
+ {
+  "item": "F006",
+  "kind": "pair",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "arches/app/media/js/views/graph/permission-manager/permission-settings-form.js",
+  "old_path": "arches/app/media/js/views/graph/permission-manager/permission-settings-form.js",
+  "old_line": 128,
+  "line": 210,
+  "before": [
+   [
+    124,
+    "        });"
+   ],
+   [
+    125,
+    "    },"
+   ],
+   [
+    126,
+    ""
+   ],
+   [
+    127,
+    "    revert: function() {"
+   ],
+   [
+    128,
+    "        var self = this;"
+   ],
+   [
+    129,
+    "        var postData = {"
+   ],
+   [
+    130,
+    "            'selectedIdentities': this.selectedIdentities(),"
+   ],
+   [
+    131,
+    "            'selectedCards': this.selectedCards()"
+   ],
+   [
+    132,
+    "        };"
+   ]
+  ],
+  "before_line": 128,
+  "before_mapped": true,
+  "after": [
+   [
+    206,
+    "            });"
+   ],
+   [
+    207,
+    "    },"
+   ],
+   [
+    208,
+    ""
+   ],
+   [
+    209,
+    "    revert: function() {"
+   ],
+   [
+    210,
+    "        var self = this;"
+   ],
+   [
+    211,
+    "        if (!this.canSubmit()) {"
+   ],
+   [
+    212,
+    "            return;"
+   ],
+   [
+    213,
+    "        }"
+   ],
+   [
+    214,
+    "        var confirm = arches.translations.graphDesignerPermissionsResetConfirm;"
+   ]
+  ],
+  "diff": "@@ -109,48 +188,64 @@ var PermissionSettingsForm = Backbone.View.extend({\n             })\n         };\n\n+        this.loading(true);\n         $.ajax({\n             type: 'POST',\n             url: arches.urls.permission_data,\n-            data: JSON.stringify(postData),\n-            success: function(res) {\n+            data: JSON.stringify(postData)\n+        })\n+            .done(function() {\n+                self.showSuccess(arches.translations.graphDesignerPermissionsApplied);\n                 self.trigger('save');\n-                self.clearUserPermissionCache();\n-                // adds event to trigger dirty state in graph-designer\n-                document.dispatchEvent(\n-                    new Event('permissionsSave')\n-                );\n-            }\n-        });\n+            })\n+            .fail(function(response) {\n+                self.showError(response);\n+            })\n+            .always(function() {\n+                self.loading(false);\n+            });\n     },\n\n     revert: function() {\n+        var self = this;\n+        if (!this.canSubmit()) {\n+            return;\n+        }\n+        var confirm = arches.translations.graphDesignerPermissionsResetConfirm;\n+        this.alert(new AlertViewModel(\n+            'ep-alert-red',\n+            confirm.title,\n... (53 more lines)"
+ },
+ {
+  "item": "F007",
+  "kind": "introduced",
+  "repository": "inventree",
+  "commit_url": "https://github.com/inventree/InvenTree/commit/99893f3453c6a213a331c022e82cbafbde7ebd51",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "src/frontend/src/components/tables/InvenTreeTable.tsx",
+  "old_path": "src/frontend/src/components/tables/InvenTreeTable.tsx",
+  "old_line": null,
+  "line": 940,
+  "before": [
+   [
+    773,
+    ""
+   ],
+   [
+    774,
+    "  // Update tableState.records when new data received"
+   ],
+   [
+    775,
+    "  useEffect(() => {"
+   ],
+   [
+    776,
+    "    tableState.setRecords(tableData ?? apiData ?? []);"
+   ],
+   [
+    777,
+    "  }, [tableData, apiData]);"
+   ],
+   [
+    778,
+    ""
+   ],
+   [
+    779,
+    "  const previewDrawer = usePreviewDrawerState();"
+   ],
+   [
+    780,
+    ""
+   ],
+   [
+    781,
+    "  // Callback to display \"preview\" view for a row (if available)"
+   ],
+   [
+    782,
+    "  const showRowPreview = useCallback("
+   ],
+   [
+    783,
+    "    (pk: string | number, targetUrl?: string) => {"
+   ],
+   [
+    784,
+    "      if (tableProps.modelType && pk) {"
+   ],
+   [
+    785,
+    "        previewDrawer.openPreview("
+   ]
+  ],
+  "before_line": 779,
+  "before_mapped": false,
+  "after": [
+   [
+    936,
+    "        params: queryParams,"
+   ],
+   [
+    937,
+    "        timeout: 10 * 1000"
+   ],
+   [
+    938,
+    "      })"
+   ],
+   [
+    939,
+    "      .then((response) => {"
+   ],
+   [
+    940,
+    "        if (generation != nestedGeneration.current) {"
+   ],
+   [
+    941,
+    "          return;"
+   ],
+   [
+    942,
+    "        }"
+   ],
+   [
+    943,
+    ""
+   ],
+   [
+    944,
+    "        let results = response.data?.results ?? response.data ?? [];"
+   ]
+  ],
+  "diff": "@@ -776,6 +862,170 @@ export function InvenTreeTableInternal<T extends Record<string, any>>({\n     tableState.setRecords(tableData ?? apiData ?? []);\n   }, [tableData, apiData]);\n\n+  // Serialized params, so that nested data is not discarded on every render\n+  const paramsKey: string = useMemo(\n+    () => JSON.stringify(tableProps.params ?? {}),\n+    [tableProps.params]\n+  );\n+\n+  // Discard nested data whenever the top-level table data is reloaded,\n+  // or the nesting configuration changes (as child rows depend on it)\n+  useEffect(() => {\n+    nestedGeneration.current += 1;\n+    // Keep the existing (empty) state object to avoid a needless re-render\n+    setNestedState((state) => (Object.keys(state).length > 0 ? {} : state));\n+  }, [\n+    props.nestedRows,\n+    url,\n+    tableData,\n+    apiData,\n+    paramsKey,\n+    pageSize,\n+    sortStatus,\n+    tableState.page,\n+    tableState.searchTerm,\n+    tableState.tableKey,\n+    tableState.filterSet.activeFilters,\n+    tableSearchParams\n+  ]);\n+\n+  // Expand or collapse a nested row, fetching child rows if required\n+  toggleNestedRow.current = (record: T) => {\n+    const nestedRows = props.nestedRows;\n+\n+    if (!nestedRows || !url) {\n+      return;\n+    }\n+\n+    const key = getRowKey(record);\n... (131 more lines)"
+ },
+ {
+  "item": "F008",
+  "kind": "introduced",
+  "repository": "lnbits",
+  "commit_url": "https://github.com/lnbits/lnbits/commit/c0806ca59c90464e424f881a92efd8033fd9bd2b",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "tests/e2e/extension-helpers.ts",
+  "old_path": "tests/e2e/extension-helpers.ts",
+  "old_line": null,
+  "line": 540,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    536,
+    "  await expect(tab).toBeVisible({timeout: 60_000})"
+   ],
+   [
+    537,
+    "  for (let attempt = 0; attempt < 3; attempt += 1) {"
+   ],
+   [
+    538,
+    "    await tab.click()"
+   ],
+   [
+    539,
+    "    try {"
+   ],
+   [
+    540,
+    "      await expect(tab).toHaveAttribute('aria-selected', 'true', {"
+   ],
+   [
+    541,
+    "        timeout: 5_000"
+   ],
+   [
+    542,
+    "      })"
+   ],
+   [
+    543,
+    "      return"
+   ],
+   [
+    544,
+    "    } catch (_error) {"
+   ]
+  ],
+  "diff": "@@ -0,0 +1,658 @@\n+import {expect, type Frame, type Locator, type Page} from '@playwright/test'\n+\n+import {\n+  browserJson,\n+  delay,\n+  isRecord,\n+  type LNbitsE2EServer,\n+  waitForResult\n+} from './fixtures'\n+\n+const INSTALLABLE_EXTENSION_REFRESH_TASK =\n+  'refresh_installable_extensions_cache'\n+\n+export type ExtensionUnderTest = {\n+  extId: string\n+  manifestUrl: string\n+  name: string\n+  permissionTexts?: string[]\n+  repository: string\n+}\n+\n+export type E2EWallet = {\n+  adminkey: string\n+  id: string\n+  inkey: string\n+  name: string\n+}\n+\n+export async function login(\n+  page: Page,\n+  server: LNbitsE2EServer\n+): Promise<void> {\n+  await page.goto('/')\n+  await page.locator('input[name=\"username\"]').fill(server.username)\n+  await page.locator('input[name=\"password\"]').fill(server.password)\n+  await page.getByRole('button', {name: /^login$/i}).click()\n+  await expect(page).toHaveURL(/\\/wallet\\/[^/]+$/)\n+  await dismissDisclaimer(page)\n+}\n... (620 more lines)"
+ },
+ {
+  "item": "F009",
+  "kind": "pair",
+  "repository": "edx-platform",
+  "commit_url": "https://github.com/openedx/edx-platform/commit/b3f862e61aa84a5f8c027081b7d1a07a8619917d",
+  "rule": "CG-SEC-013",
+  "rule_title": "Request data used as a file path",
+  "path": "cms/djangoapps/contentstore/api/views/course_import.py",
+  "old_path": "cms/djangoapps/contentstore/api/views/course_import.py",
+  "old_line": 142,
+  "line": 145,
+  "before": [
+   [
+    138,
+    "            if not course_dir.isdir():"
+   ],
+   [
+    139,
+    "                os.mkdir(course_dir)"
+   ],
+   [
+    140,
+    ""
+   ],
+   [
+    141,
+    "            log.debug(f'importing course to {temp_filepath}')"
+   ],
+   [
+    142,
+    "            with open(temp_filepath, \"wb+\") as temp_file:"
+   ],
+   [
+    143,
+    "                for chunk in request.FILES['course_data'].chunks():"
+   ],
+   [
+    144,
+    "                    temp_file.write(chunk)"
+   ],
+   [
+    145,
+    ""
+   ],
+   [
+    146,
+    "            log.info(\"Course import %s: Upload complete\", course_key)"
+   ]
+  ],
+  "before_line": 142,
+  "before_mapped": true,
+  "after": [
+   [
+    141,
+    "            os.makedirs(course_dir, exist_ok=True)"
+   ],
+   [
+    142,
+    ""
+   ],
+   [
+    143,
+    "            try:"
+   ],
+   [
+    144,
+    "                log.debug(f'importing course to {temp_filepath}')"
+   ],
+   [
+    145,
+    "                with open(temp_filepath, \"wb+\") as temp_file:"
+   ],
+   [
+    146,
+    "                    for chunk in request.FILES['course_data'].chunks():"
+   ],
+   [
+    147,
+    "                        temp_file.write(chunk)"
+   ],
+   [
+    148,
+    ""
+   ],
+   [
+    149,
+    "                log.info(\"Course import %s: Upload complete\", course_key)"
+   ]
+  ],
+  "diff": "@@ -131,22 +134,26 @@ class CourseImportView(CourseImportExportViewMixin, GenericAPIView):\n                     developer_message='Parameter in the wrong format',\n                     error_code='internal_error',\n                 )\n-            course_dir = path(settings.GITHUB_REPO_ROOT) / base64.urlsafe_b64encode(\n-                repr(course_key).encode('utf-8')\n-            ).decode('utf-8')\n+            # Staging directory private to this upload, so that a concurrent import of\n+            # the same course cannot overwrite this archive or delete it on its way out.\n+            course_dir = course_import_working_dir(course_key, f'upload-{uuid4().hex}')\n             temp_filepath = course_dir / filename\n-            if not course_dir.isdir():\n-                os.mkdir(course_dir)\n-\n-            log.debug(f'importing course to {temp_filepath}')\n-            with open(temp_filepath, \"wb+\") as temp_file:\n-                for chunk in request.FILES['course_data'].chunks():\n-                    temp_file.write(chunk)\n-\n-            log.info(\"Course import %s: Upload complete\", course_key)\n-            with open(temp_filepath, 'rb') as local_file:\n-                django_file = File(local_file)\n-                storage_path = course_import_export_storage.save('olx_import/' + filename, django_file)\n+            os.makedirs(course_dir, exist_ok=True)\n+\n+            try:\n+                log.debug(f'importing course to {temp_filepath}')\n+                with open(temp_filepath, \"wb+\") as temp_file:\n+                    for chunk in request.FILES['course_data'].chunks():\n+                        temp_file.write(chunk)\n+\n+                log.info(\"Course import %s: Upload complete\", course_key)\n+                with open(temp_filepath, 'rb') as local_file:\n+                    django_file = File(local_file)\n+                    storage_path = course_import_export_storage.save('olx_import/' + filename, django_file)\n+            finally:\n+                # The archive now lives in storage; the import task downloads it into its\n+                # own working directory, so this staging copy is no longer needed.\n+                remove_course_import_working_dir(course_dir)\n\n... (3 more lines)"
+ },
+ {
+  "item": "F010",
+  "kind": "pair",
+  "repository": "lnbits",
+  "commit_url": "https://github.com/lnbits/lnbits/commit/f5989201d9c21a4690334f91bbbb421214c989e7",
+  "rule": "CG-QUAL-102",
+  "rule_title": "Empty catch block",
+  "path": "lnbits/static/js/wasm-extension-component.js",
+  "old_path": "lnbits/static/js/wasm-extension-component.js",
+  "old_line": 904,
+  "line": 1126,
+  "before": [
+   [
+    900,
+    "      socket.addEventListener('message', event => {"
+   ],
+   [
+    901,
+    "        let data = event.data"
+   ],
+   [
+    902,
+    "        try {"
+   ],
+   [
+    903,
+    "          data = JSON.parse(event.data)"
+   ],
+   [
+    904,
+    "        } catch (_error) {}"
+   ],
+   [
+    905,
+    ""
+   ],
+   [
+    906,
+    "        this.sendBridgeEvent({"
+   ],
+   [
+    907,
+    "          event: 'payment.update',"
+   ],
+   [
+    908,
+    "          subscriptionId,"
+   ]
+  ],
+  "before_line": 904,
+  "before_mapped": true,
+  "after": [
+   [
+    1122,
+    "      socket.addEventListener('message', event => {"
+   ],
+   [
+    1123,
+    "        let data = event.data"
+   ],
+   [
+    1124,
+    "        try {"
+   ],
+   [
+    1125,
+    "          data = JSON.parse(event.data)"
+   ],
+   [
+    1126,
+    "        } catch (_error) {}"
+   ],
+   [
+    1127,
+    ""
+   ],
+   [
+    1128,
+    "        this.sendBridgeEvent({"
+   ],
+   [
+    1129,
+    "          event: 'payment.update',"
+   ],
+   [
+    1130,
+    "          subscriptionId,"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F011",
+  "kind": "pair",
+  "repository": "indico",
+  "commit_url": "https://github.com/indico/indico/commit/1ab29e13596cacf234ce75f7c0d4be217010ba6d",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "indico/modules/events/registration/util.py",
+  "old_path": "indico/modules/events/registration/util.py",
+  "old_line": 474,
+  "line": 474,
+  "before": [
+   [
+    470,
+    "    return registration"
+   ],
+   [
+    471,
+    ""
+   ],
+   [
+    472,
+    ""
+   ],
+   [
+    473,
+    "@no_autoflush"
+   ],
+   [
+    474,
+    "def modify_registration(registration, data, management=False, notify_user=True):"
+   ],
+   [
+    475,
+    "    from indico.modules.events.registration.tasks import delete_previous_registration_file"
+   ],
+   [
+    476,
+    ""
+   ],
+   [
+    477,
+    "    user = session.user if session else None"
+   ],
+   [
+    478,
+    "    old_data = snapshot_registration_data(registration)"
+   ]
+  ],
+  "before_line": 474,
+  "before_mapped": true,
+  "after": [
+   [
+    470,
+    "    return registration"
+   ],
+   [
+    471,
+    ""
+   ],
+   [
+    472,
+    ""
+   ],
+   [
+    473,
+    "@no_autoflush"
+   ],
+   [
+    474,
+    "def modify_registration(registration, data, management=False, notify_user=True):"
+   ],
+   [
+    475,
+    "    from indico.modules.events.registration.tasks import delete_previous_registration_file"
+   ],
+   [
+    476,
+    ""
+   ],
+   [
+    477,
+    "    user = session.user if session else None"
+   ],
+   [
+    478,
+    "    old_data = snapshot_registration_data(registration)"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F012",
+  "kind": "pair",
+  "repository": "documenso",
+  "commit_url": "https://github.com/documenso/documenso/commit/9c27ce6d185f7e25eec80439b931c4709723a2ae",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "packages/app-tests/e2e/teams/team-documents.spec.ts",
+  "old_path": "packages/app-tests/e2e/teams/team-documents.spec.ts",
+  "old_line": 37,
+  "line": 29,
+  "before": [
+   [
+    33,
+    ""
+   ],
+   [
+    34,
+    "    // Check counts after filtering."
+   ],
+   [
+    35,
+    "    await checkDocumentTabCount(page, 'Inbox', 0);"
+   ],
+   [
+    36,
+    "    await checkDocumentTabCount(page, 'Pending', 2);"
+   ],
+   [
+    37,
+    "    await checkDocumentTabCount(page, 'Completed', 0);"
+   ],
+   [
+    38,
+    "    await checkDocumentTabCount(page, 'Draft', 1);"
+   ],
+   [
+    39,
+    "    await checkDocumentTabCount(page, 'All', 3);"
+   ],
+   [
+    40,
+    ""
+   ],
+   [
+    41,
+    "    await apiSignout({ page });"
+   ]
+  ],
+  "before_line": 37,
+  "before_mapped": true,
+  "after": [
+   [
+    25,
+    "    // Apply filter."
+   ],
+   [
+    26,
+    "    await toggleDocumentSenderFilter(page, teamMember2.name ?? '');"
+   ],
+   [
+    27,
+    ""
+   ],
+   [
+    28,
+    "    // Check counts after filtering."
+   ],
+   [
+    29,
+    "    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 1, all: 3 });"
+   ],
+   [
+    30,
+    ""
+   ],
+   [
+    31,
+    "    await apiSignout({ page });"
+   ],
+   [
+    32,
+    "  }"
+   ],
+   [
+    33,
+    "});"
+   ]
+  ],
+  "diff": "@@ -20,23 +20,13 @@ test('[TEAMS]: check team documents count', async ({ page }) => {\n     });\n\n     // Check document counts.\n-    await checkDocumentTabCount(page, 'Inbox', 0);\n-    await checkDocumentTabCount(page, 'Pending', 2);\n-    await checkDocumentTabCount(page, 'Completed', 1);\n-    await checkDocumentTabCount(page, 'Draft', 2);\n-    await checkDocumentTabCount(page, 'All', 5);\n+    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 1, draft: 2, all: 5 });\n\n     // Apply filter.\n-    await page.locator('button').filter({ hasText: 'Sender: All' }).click();\n-    await page.getByRole('option', { name: teamMember2.name ?? '' }).click();\n-    await page.waitForURL(/senderIds/);\n+    await toggleDocumentSenderFilter(page, teamMember2.name ?? '');\n\n     // Check counts after filtering.\n-    await checkDocumentTabCount(page, 'Inbox', 0);\n-    await checkDocumentTabCount(page, 'Pending', 2);\n-    await checkDocumentTabCount(page, 'Completed', 0);\n-    await checkDocumentTabCount(page, 'Draft', 1);\n-    await checkDocumentTabCount(page, 'All', 3);\n+    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 1, all: 3 });\n\n     await apiSignout({ page });\n   }"
+ },
+ {
+  "item": "F013",
+  "kind": "pair",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/863b1b29a803f6c456b04dd82d19a53c7afc9102",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "packages/hoppscotch-common/src/lib/sync/settings/index.ts",
+  "old_path": "packages/hoppscotch-selfhost-web/src/platform/settings/web/index.ts",
+  "old_line": 49,
+  "line": 42,
+  "before": [
+   [
+    45,
+    "  const res = await getUserSettings()"
+   ],
+   [
+    46,
+    ""
+   ],
+   [
+    47,
+    "  // create user settings if it doesn't exist"
+   ],
+   [
+    48,
+    "  E.isLeft(res) &&"
+   ],
+   [
+    49,
+    "    res.left.error == \"user_settings/not_found\" &&"
+   ],
+   [
+    50,
+    "    (await createUserSettings(JSON.stringify(getDefaultSettings())))"
+   ],
+   [
+    51,
+    ""
+   ],
+   [
+    52,
+    "  if (E.isRight(res)) {"
+   ],
+   [
+    53,
+    "    runDispatchWithOutSyncing(() => {"
+   ]
+  ],
+  "before_line": 49,
+  "before_mapped": true,
+  "after": [
+   [
+    38,
+    "async function loadUserSettings() {"
+   ],
+   [
+    39,
+    "  const res = await getUserSettings()"
+   ],
+   [
+    40,
+    ""
+   ],
+   [
+    41,
+    "  // create user settings if it doesn't exist"
+   ],
+   [
+    42,
+    "  if (E.isLeft(res) && res.left.error == \"user_settings/not_found\") {"
+   ],
+   [
+    43,
+    "    const createRes = await createUserSettings("
+   ],
+   [
+    44,
+    "      JSON.stringify(getDefaultSettings())"
+   ],
+   [
+    45,
+    "    )"
+   ],
+   [
+    46,
+    ""
+   ]
+  ],
+  "diff": "@@ -45,11 +39,19 @@ async function loadUserSettings() {\n   const res = await getUserSettings()\n\n   // create user settings if it doesn't exist\n-  E.isLeft(res) &&\n-    res.left.error == \"user_settings/not_found\" &&\n-    (await createUserSettings(JSON.stringify(getDefaultSettings())))\n+  if (E.isLeft(res) && res.left.error == \"user_settings/not_found\") {\n+    const createRes = await createUserSettings(\n+      JSON.stringify(getDefaultSettings())\n+    )\n\n-  if (E.isRight(res)) {\n+    if (E.isRight(createRes)) {\n+      runDispatchWithOutSyncing(() => {\n+        bulkApplySettings(\n+          JSON.parse(createRes.right.createUserSettings.properties)\n+        )\n+      })\n+    }\n+  } else if (E.isRight(res)) {\n     runDispatchWithOutSyncing(() => {\n       bulkApplySettings(JSON.parse(res.right.me.settings.properties))\n     })\n"
+ },
+ {
+  "item": "F014",
+  "kind": "introduced",
+  "repository": "erpnext",
+  "commit_url": "https://github.com/frappe/erpnext/commit/8c85cef29b0b80a23a499516a94d4319cf45503d",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "erpnext/stock/doctype/landed_cost_voucher/landed_cost_voucher.js",
+  "old_path": "erpnext/stock/doctype/landed_cost_voucher/landed_cost_voucher.js",
+  "old_line": null,
+  "line": 119,
+  "before": [
+   [
+    112,
+    "\t\t\t\t\t\tprecision(\"applicable_charges\", item)"
+   ],
+   [
+    113,
+    "\t\t\t\t\t);"
+   ],
+   [
+    114,
+    "\t\t\t\t\ttotal_charges += item.applicable_charges;"
+   ],
+   [
+    115,
+    "\t\t\t\t});"
+   ],
+   [
+    116,
+    ""
+   ],
+   [
+    117,
+    "\t\t\t\tif (total_charges != this.frm.doc.total_taxes_and_charges) {"
+   ],
+   [
+    118,
+    "\t\t\t\t\tvar diff = this.frm.doc.total_taxes_and_charges - flt(total_charges);"
+   ],
+   [
+    119,
+    "\t\t\t\t\titems.slice(-1)[0].applicable_charges += diff;"
+   ],
+   [
+    120,
+    "\t\t\t\t}"
+   ],
+   [
+    121,
+    "\t\t\t\trefresh_field(\"items\");"
+   ],
+   [
+    122,
+    "\t\t\t}"
+   ],
+   [
+    123,
+    "\t\t}"
+   ],
+   [
+    124,
+    "\t}"
+   ]
+  ],
+  "before_line": 118,
+  "before_mapped": false,
+  "after": [
+   [
+    115,
+    "\t\t\t\t});"
+   ],
+   [
+    116,
+    ""
+   ],
+   [
+    117,
+    "\t\t\t\tvar charge_precision = precision(\"applicable_charges\", items[0]);"
+   ],
+   [
+    118,
+    "\t\t\t\tvar total = flt(this.frm.doc.total_taxes_and_charges);"
+   ],
+   [
+    119,
+    "\t\t\t\tvar sign = total < 0 ? -1 : 1;"
+   ],
+   [
+    120,
+    "\t\t\t\tvar diff = flt(total - total_charges, charge_precision);"
+   ],
+   [
+    121,
+    "\t\t\t\tfor (const item of items.slice().reverse()) {"
+   ],
+   [
+    122,
+    "\t\t\t\t\tif (!diff) break;"
+   ],
+   [
+    123,
+    "\t\t\t\t\tvar share = flt(item.applicable_charges) * sign;"
+   ]
+  ],
+  "diff": "@@ -114,9 +114,19 @@ erpnext.stock.LandedCostVoucher = class LandedCostVoucher extends erpnext.stock.\n \t\t\t\t\ttotal_charges += item.applicable_charges;\n \t\t\t\t});\n\n-\t\t\t\tif (total_charges != this.frm.doc.total_taxes_and_charges) {\n-\t\t\t\t\tvar diff = this.frm.doc.total_taxes_and_charges - flt(total_charges);\n-\t\t\t\t\titems.slice(-1)[0].applicable_charges += diff;\n+\t\t\t\tvar charge_precision = precision(\"applicable_charges\", items[0]);\n+\t\t\t\tvar total = flt(this.frm.doc.total_taxes_and_charges);\n+\t\t\t\tvar sign = total < 0 ? -1 : 1;\n+\t\t\t\tvar diff = flt(total - total_charges, charge_precision);\n+\t\t\t\tfor (const item of items.slice().reverse()) {\n+\t\t\t\t\tif (!diff) break;\n+\t\t\t\t\tvar share = flt(item.applicable_charges) * sign;\n+\t\t\t\t\tvar adjustment = diff * sign > 0 ? diff : sign * Math.max(diff * sign, -share);\n+\t\t\t\t\titem.applicable_charges = flt(\n+\t\t\t\t\t\tflt(item.applicable_charges) + adjustment,\n+\t\t\t\t\t\tcharge_precision\n+\t\t\t\t\t);\n+\t\t\t\t\tdiff = flt(diff - adjustment, charge_precision);\n \t\t\t\t}\n \t\t\t\trefresh_field(\"items\");\n \t\t\t}\n"
+ },
+ {
+  "item": "F015",
+  "kind": "introduced",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": null,
+  "line": 806,
+  "before": [
+   [
+    687,
+    "          });"
+   ],
+   [
+    688,
+    "        },"
+   ],
+   [
+    689,
+    "        timeout"
+   ],
+   [
+    690,
+    "      );"
+   ],
+   [
+    691,
+    ""
+   ],
+   [
+    692,
+    "      describe(\"Event Type that requires confirmation\", () => {"
+   ],
+   [
+    693,
+    "        // NOTE: Tests for BOOKING_REQUESTED webhook have been moved to the new webhook architecture test suite"
+   ],
+   [
+    694,
+    "        // See packages/features/webhooks/lib/__tests__/ for tests using the producer/consumer pattern"
+   ],
+   [
+    695,
+    ""
+   ],
+   [
+    696,
+    "        test("
+   ],
+   [
+    697,
+    "          `should rechedule a booking, that requires confirmation, without confirmation - When booker is the organizer of the existing booking as well as the event-type"
+   ],
+   [
+    698,
+    "          1. Should cancel the existing booking"
+   ],
+   [
+    699,
+    "          2. Should delete existing calendar invite and Video meeting"
+   ]
+  ],
+  "before_line": 693,
+  "before_mapped": false,
+  "after": [
+   [
+    802,
+    "                  {"
+   ],
+   [
+    803,
+    "                    type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    804,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    805,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    806,
+    "                    meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    807,
+    "                    meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    808,
+    "                  },"
+   ],
+   [
+    809,
+    "                  {"
+   ],
+   [
+    810,
+    "                    type: appStoreMetadata.googlecalendar.type,"
+   ]
+  ],
+  "diff": "@@ -690,8 +660,201 @@ describe(\"handleNewBooking\", () => {\n       );\n\n       describe(\"Event Type that requires confirmation\", () => {\n-        // NOTE: Tests for BOOKING_REQUESTED webhook have been moved to the new webhook architecture test suite\n-        // See packages/features/webhooks/lib/__tests__/ for tests using the producer/consumer pattern\n+        test(\n+          `should reschedule a booking that requires confirmation in PENDING state - When a booker(who is not the organizer himself) is doing the reschedule\n+          1. Should cancel the existing booking\n+          2. Should delete existing calendar invite and Video meeting\n+          2. Should create a new booking in the database in PENDING state\n+          3. Should send BOOKING Requested scenario emails to the booker as well as organizer\n+          4. Should trigger BOOKING_REQUESTED webhook instead of BOOKING_RESCHEDULED\n+    `,\n+          async ({ emails }) => {\n+            const handleNewBooking = getNewBookingHandler();\n+            const subscriberUrl = \"http://my-webhook.example.com\";\n+            const booker = getBooker({\n+              email: \"booker@example.com\",\n+              name: \"Booker\",\n+            });\n+\n+            const organizer = getOrganizer({\n+              name: \"Organizer\",\n+              email: \"organizer@example.com\",\n+              id: 101,\n+              schedules: [TestData.schedules.IstWorkHours],\n+              credentials: [getGoogleCalendarCredential()],\n+              selectedCalendars: [TestData.selectedCalendars.google],\n+            });\n+            const { dateString: plus1DateString } = getDate({ dateIncrement: 1 });\n+            const uidOfBookingToBeRescheduled = \"n5Wv3eHgconAED2j4gcVhP\";\n+\n+            const scenarioData = getScenarioData({\n+              webhooks: [\n+                {\n+                  userId: organizer.id,\n+                  eventTriggers: [\"BOOKING_CREATED\"],\n+                  subscriberUrl,\n+                  active: true,\n... (164 more lines)"
+ },
+ {
+  "item": "F016",
+  "kind": "pair",
+  "repository": "kitsune",
+  "commit_url": "https://github.com/mozilla/kitsune/commit/59b6937db573505c764bec9c87bd786981848487",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_line": 633,
+  "line": 633,
+  "before": [
+   [
+    629,
+    "    this.closeTag = \"\";"
+   ],
+   [
+    630,
+    "    this.defaultText = \"\";"
+   ],
+   [
+    631,
+    "  },"
+   ],
+   [
+    632,
+    "  openModal: function (ev) {"
+   ],
+   [
+    633,
+    "    var me = this;"
+   ],
+   [
+    634,
+    "    var editorEl = me.textarea.closest(\".editor\");"
+   ],
+   [
+    635,
+    "    var mediaSearchUrl = editorEl ? editorEl.dataset.mediaSearchUrl : undefined;"
+   ],
+   [
+    636,
+    "    var galleryUrl = editorEl ? editorEl.dataset.mediaGalleryUrl : \"\";"
+   ],
+   [
+    637,
+    "    var html = parseHTML("
+   ]
+  ],
+  "before_line": 633,
+  "before_mapped": true,
+  "after": [
+   [
+    629,
+    "    this.closeTag = \"\";"
+   ],
+   [
+    630,
+    "    this.defaultText = \"\";"
+   ],
+   [
+    631,
+    "  },"
+   ],
+   [
+    632,
+    "  openModal: function (ev) {"
+   ],
+   [
+    633,
+    "    var me = this;"
+   ],
+   [
+    634,
+    "    var editorEl = me.textarea.closest(\".editor\");"
+   ],
+   [
+    635,
+    "    var mediaSearchUrl = editorEl ? editorEl.dataset.mediaSearchUrl : undefined;"
+   ],
+   [
+    636,
+    "    var galleryUrl = editorEl ? editorEl.dataset.mediaGalleryUrl : \"\";"
+   ],
+   [
+    637,
+    "    var html = parseHTML("
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F017",
+  "kind": "pair",
+  "repository": "openlibrary",
+  "commit_url": "https://github.com/internetarchive/openlibrary/commit/53015559ebcd126850e7b07792ebc7bcfa847919",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "openlibrary/plugins/openlibrary/js/jsdef.js",
+  "old_path": "openlibrary/plugins/openlibrary/js/jsdef.js",
+  "old_line": 77,
+  "line": 80,
+  "before": [
+   [
+    73,
+    "    this.index0 = -1;"
+   ],
+   [
+    74,
+    "}"
+   ],
+   [
+    75,
+    ""
+   ],
+   [
+    76,
+    "ForLoop.prototype.next = function() {"
+   ],
+   [
+    77,
+    "    var i = this.index0+1;"
+   ],
+   [
+    78,
+    ""
+   ],
+   [
+    79,
+    "    this.index0 = i;"
+   ],
+   [
+    80,
+    "    this.index = i+1;"
+   ],
+   [
+    81,
+    ""
+   ]
+  ],
+  "before_line": 77,
+  "before_mapped": true,
+  "after": [
+   [
+    76,
+    "    this.index0 = -1;"
+   ],
+   [
+    77,
+    "}"
+   ],
+   [
+    78,
+    ""
+   ],
+   [
+    79,
+    "ForLoop.prototype.next = function () {"
+   ],
+   [
+    80,
+    "    var i = this.index0 + 1;"
+   ],
+   [
+    81,
+    ""
+   ],
+   [
+    82,
+    "    this.index0 = i;"
+   ],
+   [
+    83,
+    "    this.index = i + 1;"
+   ],
+   [
+    84,
+    ""
+   ]
+  ],
+  "diff": "@@ -73,17 +76,17 @@ export function ForLoop(parent, seq) {\n     this.index0 = -1;\n }\n\n-ForLoop.prototype.next = function() {\n-    var i = this.index0+1;\n+ForLoop.prototype.next = function () {\n+    var i = this.index0 + 1;\n\n     this.index0 = i;\n-    this.index = i+1;\n+    this.index = i + 1;\n\n-    this.first = (i === 0);\n-    this.last = (i === this.length-1);\n+    this.first = i === 0;\n+    this.last = i === this.length - 1;\n\n-    this.odd = (this.index % 2 === 1);\n-    this.even = (this.index % 2 === 0);\n+    this.odd = this.index % 2 === 1;\n+    this.even = this.index % 2 === 0;\n     this.parity = ['even', 'odd'][this.index % 2];\n\n     this.revindex0 = this.length - i;"
+ },
+ {
+  "item": "F018",
+  "kind": "pair",
+  "repository": "ckan",
+  "commit_url": "https://github.com/ckan/ckan/commit/ea3c0fd8814de0fa83e744bcb4d5ab5a93902a34",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "ckan/logic/action/update.py",
+  "old_path": "ckan/logic/action/update.py",
+  "old_line": 474,
+  "line": 500,
+  "before": [
+   [
+    470,
+    ""
+   ],
+   [
+    471,
+    "    return pkg_custom"
+   ],
+   [
+    472,
+    ""
+   ],
+   [
+    473,
+    ""
+   ],
+   [
+    474,
+    "def package_revise(context: Context, data_dict: DataDict) -> ActionResult.PackageRevise:"
+   ],
+   [
+    475,
+    "    '''Revise a dataset (package) selectively with match, filter and"
+   ],
+   [
+    476,
+    "    update parameters."
+   ],
+   [
+    477,
+    ""
+   ],
+   [
+    478,
+    "    You must be authorized to edit the dataset and the groups that it belongs"
+   ]
+  ],
+  "before_line": 474,
+  "before_mapped": true,
+  "after": [
+   [
+    496,
+    ""
+   ],
+   [
+    497,
+    "    return pkg_custom"
+   ],
+   [
+    498,
+    ""
+   ],
+   [
+    499,
+    ""
+   ],
+   [
+    500,
+    "def package_revise(context: Context, data_dict: DataDict) -> ActionResult.PackageRevise:"
+   ],
+   [
+    501,
+    "    '''Revise a dataset (package) selectively with match, filter and"
+   ],
+   [
+    502,
+    "    update parameters."
+   ],
+   [
+    503,
+    ""
+   ],
+   [
+    504,
+    "    You must be authorized to edit the dataset and the groups that it belongs"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F019",
+  "kind": "pair",
+  "repository": "inventree",
+  "commit_url": "https://github.com/inventree/InvenTree/commit/5244b8a4f21436f699ea266eb5a7381f899409f0",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "src/backend/InvenTree/plugin/registry.py",
+  "old_path": "src/backend/InvenTree/plugin/registry.py",
+  "old_line": 688,
+  "line": 689,
+  "before": [
+   [
+    684,
+    ""
+   ],
+   [
+    685,
+    "    # endregion"
+   ],
+   [
+    686,
+    ""
+   ],
+   [
+    687,
+    "    # region general internal loading / activating / deactivating / unloading"
+   ],
+   [
+    688,
+    "    def _init_plugin(self, plugin, configs: dict):"
+   ],
+   [
+    689,
+    "        \"\"\"Initialise a single plugin."
+   ],
+   [
+    690,
+    ""
+   ],
+   [
+    691,
+    "        Args:"
+   ],
+   [
+    692,
+    "            plugin: Plugin module"
+   ]
+  ],
+  "before_line": 688,
+  "before_mapped": true,
+  "after": [
+   [
+    685,
+    ""
+   ],
+   [
+    686,
+    "    # endregion"
+   ],
+   [
+    687,
+    ""
+   ],
+   [
+    688,
+    "    # region general internal loading / activating / deactivating / unloading"
+   ],
+   [
+    689,
+    "    def _init_plugin(self, plugin, configs: dict):"
+   ],
+   [
+    690,
+    "        \"\"\"Initialise a single plugin."
+   ],
+   [
+    691,
+    ""
+   ],
+   [
+    692,
+    "        Args:"
+   ],
+   [
+    693,
+    "            plugin: Plugin module"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F020",
+  "kind": "introduced",
+  "repository": "ckan",
+  "commit_url": "https://github.com/ckan/ckan/commit/7a60264189f543fba04043d2193b09f545a6ef32",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "ckan/public-midnight-blue/base/javascript/modules/data-viewer.js",
+  "old_path": "ckan/public-midnight-blue/base/javascript/modules/data-viewer.js",
+  "old_line": null,
+  "line": 27,
+  "before": [
+   [
+    21,
+    "      $('.data-viewer-error', parent).removeClass('js-hide');"
+   ],
+   [
+    22,
+    "       this.el.hide();"
+   ],
+   [
+    23,
+    "    },"
+   ],
+   [
+    24,
+    ""
+   ],
+   [
+    25,
+    "    _onLoad: function() {"
+   ],
+   [
+    26,
+    "      var self = this;"
+   ],
+   [
+    27,
+    "      var loc = $('body').data('site-root');"
+   ],
+   [
+    28,
+    "      // see if page is in part of the same domain"
+   ],
+   [
+    29,
+    "      if (this.el.attr('src').substring(0, loc.length) === loc) {"
+   ],
+   [
+    30,
+    "        this._recalibrate();"
+   ],
+   [
+    31,
+    "        setTimeout(function() {"
+   ],
+   [
+    32,
+    "          self._recalibrate();"
+   ],
+   [
+    33,
+    "        }, this.options.timeout);"
+   ]
+  ],
+  "before_line": 27,
+  "before_mapped": false,
+  "after": [
+   [
+    23,
+    "    },"
+   ],
+   [
+    24,
+    ""
+   ],
+   [
+    25,
+    "    _onLoad: function() {"
+   ],
+   [
+    26,
+    "      var self = this;"
+   ],
+   [
+    27,
+    "      var loc = document.head.querySelector(['meta[name=site-root]'])?.content;"
+   ],
+   [
+    28,
+    "      // see if page is in part of the same domain"
+   ],
+   [
+    29,
+    "      if (this.el.attr('src').substring(0, loc.length) === loc) {"
+   ],
+   [
+    30,
+    "        this._recalibrate();"
+   ],
+   [
+    31,
+    "        setTimeout(function() {"
+   ]
+  ],
+  "diff": "@@ -24,7 +24,7 @@ this.ckan.module('data-viewer', function (jQuery) {\n\n     _onLoad: function() {\n       var self = this;\n-      var loc = $('body').data('site-root');\n+      var loc = document.head.querySelector(['meta[name=site-root]'])?.content;\n       // see if page is in part of the same domain\n       if (this.el.attr('src').substring(0, loc.length) === loc) {\n         this._recalibrate();\n"
+ },
+ {
+  "item": "F021",
+  "kind": "pair",
+  "repository": "warehouse",
+  "commit_url": "https://github.com/pypi/warehouse/commit/7320d9052b59a7e3b1c2122034396f5d339cd3e0",
+  "rule": "CG-SEC-103",
+  "rule_title": "DOM XSS sink assigned a non-literal value",
+  "path": "tests/frontend/filter_list_controller_test.js",
+  "old_path": "tests/frontend/filter_list_controller_test.js",
+  "old_line": 39,
+  "line": 101,
+  "before": [
+   [
+    35,
+    "  describe(\"is initialized as expected\", () => {"
+   ],
+   [
+    36,
+    "    describe(\"makes expected elements visible\", () => {"
+   ],
+   [
+    37,
+    "      let application;"
+   ],
+   [
+    38,
+    "      beforeEach(() => {"
+   ],
+   [
+    39,
+    "        document.body.innerHTML = `"
+   ],
+   [
+    40,
+    "      <div id=\"controller\" data-controller=\"filter-list\">"
+   ],
+   [
+    41,
+    "        ${testFixtureHTMLVisibilityToggle}"
+   ],
+   [
+    42,
+    "      </div>"
+   ],
+   [
+    43,
+    "      `;"
+   ]
+  ],
+  "before_line": 39,
+  "before_mapped": true,
+  "after": [
+   [
+    97,
+    "    expect(Array.from(filterMyAttr.options).map(option => [option.value, option.selected])).toEqual(values);"
+   ],
+   [
+    98,
+    "  };"
+   ],
+   [
+    99,
+    "  const appStart = async function () {"
+   ],
+   [
+    100,
+    "    const div = document.createElement(\"div\");"
+   ],
+   [
+    101,
+    "    div.innerHTML = `"
+   ],
+   [
+    102,
+    "      <div id=\"controller\" data-controller=\"filter-list\">"
+   ],
+   [
+    103,
+    "        ${testFixtureHTMLVisibilityToggle}"
+   ],
+   [
+    104,
+    "        ${testFixtureHTMLShowing}"
+   ],
+   [
+    105,
+    "        ${testFixtureHTMLFilters}"
+   ]
+  ],
+  "diff": "@@ -5,226 +5,424 @@\n\n import {Application} from \"@hotwired/stimulus\";\n import FilterListController from \"../../warehouse/static/js/warehouse/controllers/filter_list_controller\";\n+import {delay} from \"./utils\";\n\n\n const testFixtureHTMLVisibilityToggle = `\n-<p id=\"initial-toggle-visibility-shown\" class=\"hidden initial-toggle-visibility\">Initially hidden, should end up shown.</p>\n-<p id=\"initial-toggle-visibility-hidden\" class=\"initial-toggle-visibility\">Initially shown, should end up hidden.</p>\n+<p id=\"initial-toggle-visibility-shown\" class=\"hidden initial-toggle-visibility\">\n+    Initially hidden, should end up shown.\n+</p>\n+<p id=\"initial-toggle-visibility-hidden\" class=\"initial-toggle-visibility\">\n+    Initially shown, should end up hidden.\n+</p>\n `;\n const testFixtureHTMLShowing = `\n <p id=\"shown-and-total\" data-filter-list-target=\"summary\"></p>\n `;\n const testFixtureHTMLFilters = `\n-<input id=\"filter-input\" type=\"text\" data-action=\"filter-list#filter\" data-filter-list-target=\"filter\" data-filtered-source=\"contentType\">\n-        <select id=\"filter-select\"  data-action=\"filter-list#filter\" data-filter-list-target=\"filter\" data-filtered-source=\"myattr\">\n-          <option selected value=\"\">My Attrs</option>\n-          <option value=\"myattr1\">myattr 1</option>\n-          <option value=\"myattr2\">myattr 2</option>\n-          <option value=\"myattr3\">myattr 3</option>\n-        </select>\n+<input id=\"filter-input-description\" type=\"text\" data-action=\"filter-list#filter\"\n+    data-filter-list-target=\"filter\" data-filtered-source=\"description\" data-comparison-type=\"includes\"\n+    data-auto-update-url-querystring=\"false\">\n+<select id=\"filter-select-myattr\" data-action=\"filter-list#filter\"\n+    data-filter-list-target=\"filter\" data-filtered-source=\"myattr\" data-comparison-type=\"exact\"\n+    data-auto-update-url-querystring=\"true\">\n+  <option value=\"\" selected>My Attrs</option>\n+  <option value=\"myattr1\">myattr 1</option>\n+  <option value=\"myattr2\">myattr 2</option>\n+  <option value=\"myattr3\">myattr 3</option>\n+</select>\n+<select id=\"filter-select-contentType\" data-action=\"filter-list#filter\"\n... (557 more lines)"
+ },
+ {
+  "item": "F022",
+  "kind": "pair",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/ef3a5efc290afac95e3a6b5e3c8edabd51a9ddab",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "arches/app/permissions/arches_default_deny.py",
+  "old_path": "arches/app/permissions/arches_default_deny.py",
+  "old_line": 230,
+  "line": 264,
+  "before": [
+   [
+    226,
+    "        should_access.should(principal_user_term_filter)"
+   ],
+   [
+    227,
+    "        has_access.filter(should_access)"
+   ],
+   [
+    228,
+    "        return has_access"
+   ],
+   [
+    229,
+    ""
+   ],
+   [
+    230,
+    "    def get_search_ui_permissions("
+   ],
+   [
+    231,
+    "        self, user: User, search_result: dict, groups: list[str]"
+   ],
+   [
+    232,
+    "    ) -> dict:"
+   ],
+   [
+    233,
+    "        result = {}"
+   ],
+   [
+    234,
+    ""
+   ]
+  ],
+  "before_line": 230,
+  "before_mapped": true,
+  "after": [
+   [
+    260,
+    "        should_access.should(principal_user_term_filter)"
+   ],
+   [
+    261,
+    "        has_access.filter(should_access)"
+   ],
+   [
+    262,
+    "        return has_access"
+   ],
+   [
+    263,
+    ""
+   ],
+   [
+    264,
+    "    def get_search_ui_permissions("
+   ],
+   [
+    265,
+    "        self, user: User, search_result: dict, groups: list[str]"
+   ],
+   [
+    266,
+    "    ) -> dict:"
+   ],
+   [
+    267,
+    "        result = {}"
+   ],
+   [
+    268,
+    ""
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F023",
+  "kind": "pair",
+  "repository": "habitica",
+  "commit_url": "https://github.com/HabitRPG/habitica/commit/e6ffd69148396eeff7130b102a93d774fa11dcbc",
+  "rule": "CG-QUAL-103",
+  "rule_title": "Function is too complex",
+  "path": "website/common/script/ops/feed.js",
+  "old_path": "website/common/script/ops/feed.js",
+  "old_line": 39,
+  "line": 37,
+  "before": [
+   [
+    35,
+    "    egg: pet.text(req.language),"
+   ],
+   [
+    36,
+    "  }, req.language);"
+   ],
+   [
+    37,
+    "}"
+   ],
+   [
+    38,
+    ""
+   ],
+   [
+    39,
+    "export default function feed (user, req = {}, analytics) {"
+   ],
+   [
+    40,
+    "  let pet = get(req, 'params.pet');"
+   ],
+   [
+    41,
+    "  const foodK = get(req, 'params.food');"
+   ],
+   [
+    42,
+    "  let amount = Number(get(req.query, 'amount', 1));"
+   ],
+   [
+    43,
+    "  let foodFactor;"
+   ]
+  ],
+  "before_line": 39,
+  "before_mapped": true,
+  "after": [
+   [
+    33,
+    "    egg: pet.text(req.language),"
+   ],
+   [
+    34,
+    "  }, req.language);"
+   ],
+   [
+    35,
+    "}"
+   ],
+   [
+    36,
+    ""
+   ],
+   [
+    37,
+    "export default function feed (user, req = {}) {"
+   ],
+   [
+    38,
+    "  let pet = get(req, 'params.pet');"
+   ],
+   [
+    39,
+    "  const foodK = get(req, 'params.food');"
+   ],
+   [
+    40,
+    "  let amount = Number(get(req.query, 'amount', 1));"
+   ],
+   [
+    41,
+    "  let foodFactor;"
+   ]
+  ],
+  "diff": "@@ -36,7 +34,7 @@ function evolve (user, pet, req) {\n   }, req.language);\n }\n\n-export default function feed (user, req = {}, analytics) {\n+export default function feed (user, req = {}) {\n   let pet = get(req, 'params.pet');\n   const foodK = get(req, 'params.food');\n   let amount = Number(get(req.query, 'amount', 1));"
+ },
+ {
+  "item": "F024",
+  "kind": "introduced",
+  "repository": "geonode",
+  "commit_url": "https://github.com/GeoNode/geonode/commit/6f00ca5b66b2459cf3a6556434d476810cabe0d4",
+  "rule": "CG-SEC-002",
+  "rule_title": "Hardcoded secret",
+  "path": "geonode/geoserver/gwc.py",
+  "old_path": "geonode/geoserver/gwc.py",
+  "old_line": null,
+  "line": 50,
+  "before": [
+   [
+    35,
+    "    \"\"\""
+   ],
+   [
+    36,
+    "    A GeoWebCache REST client for interacting with the GWC API."
+   ],
+   [
+    37,
+    "    \"\"\""
+   ],
+   [
+    38,
+    ""
+   ],
+   [
+    39,
+    "    def __init__(self) -> None:"
+   ],
+   [
+    40,
+    "        self.base_url = f\"{ogc_server_settings.LOCATION}gwc/rest/\""
+   ],
+   [
+    41,
+    ""
+   ],
+   [
+    42,
+    "    def _post(self, urlpath, data):"
+   ],
+   [
+    43,
+    "        _user, _password = ogc_server_settings.credentials"
+   ],
+   [
+    44,
+    ""
+   ],
+   [
+    45,
+    "        url = f\"{self.base_url}{urlpath}\""
+   ],
+   [
+    46,
+    "        r = requests.post(url=url, data=data, auth=HTTPBasicAuth(_user, _password), timeout=30)"
+   ],
+   [
+    47,
+    "        logger.debug(f'POST response: code:{r.status_code} --> \"{r.text}\"')"
+   ]
+  ],
+  "before_line": 41,
+  "before_mapped": false,
+  "after": [
+   [
+    46,
+    "        else:"
+   ],
+   [
+    47,
+    "            logger.debug(f\"{r.request.method} response: code:{r.status_code} --> {len(r.text)} bytes\")"
+   ],
+   [
+    48,
+    ""
+   ],
+   [
+    49,
+    "    def _get(self, urlpath):"
+   ],
+   [
+    50,
+    "        _user, _password = ogc_server_settings.credentials"
+   ],
+   [
+    51,
+    ""
+   ],
+   [
+    52,
+    "        url = f\"{self.base_url}{urlpath}\""
+   ],
+   [
+    53,
+    "        r = requests.get(url=url, auth=HTTPBasicAuth(_user, _password), timeout=30)"
+   ],
+   [
+    54,
+    "        self.__log_response(r)"
+   ]
+  ],
+  "diff": "@@ -36,15 +36,40 @@ class GWCClient:\n     A GeoWebCache REST client for interacting with the GWC API.\n     \"\"\"\n\n-    def __init__(self) -> None:\n+    def __init__(self, **kwargs) -> None:\n         self.base_url = f\"{ogc_server_settings.LOCATION}gwc/rest/\"\n+        self.debug = kwargs.get(\"debug\", False)\n+\n+    def __log_response(self, r):\n+        if self.debug:\n+            logger.debug(f'{r.request.method} response: code:{r.status_code} --> \"{r.text}\"')\n+        else:\n+            logger.debug(f\"{r.request.method} response: code:{r.status_code} --> {len(r.text)} bytes\")\n+\n+    def _get(self, urlpath):\n+        _user, _password = ogc_server_settings.credentials\n+\n+        url = f\"{self.base_url}{urlpath}\"\n+        r = requests.get(url=url, auth=HTTPBasicAuth(_user, _password), timeout=30)\n+        self.__log_response(r)\n+        return r\n\n     def _post(self, urlpath, data):\n         _user, _password = ogc_server_settings.credentials\n\n         url = f\"{self.base_url}{urlpath}\"\n         r = requests.post(url=url, data=data, auth=HTTPBasicAuth(_user, _password), timeout=30)\n-        logger.debug(f'POST response: code:{r.status_code} --> \"{r.text}\"')\n+        self.__log_response(r)\n+        return r\n+\n+    def _put(self, urlpath, data):\n+        _user, _password = ogc_server_settings.credentials\n+\n+        url = f\"{self.base_url}{urlpath}\"\n+        r = requests.put(\n+            url=url, data=data, headers={\"Content-Type\": \"text/xml\"}, auth=HTTPBasicAuth(_user, _password), timeout=30\n+        )\n+        self.__log_response(r)\n... (3 more lines)"
+ },
+ {
+  "item": "F025",
+  "kind": "pair",
+  "repository": "uptime-kuma",
+  "commit_url": "https://github.com/louislam/uptime-kuma/commit/4e7c4ae382f4038369922a7981babba43403ff1c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "test/backend-test/test-migration-v2-to-v3.ts",
+  "old_path": "test/backend-test/test-migration-v2-to-v3.ts",
+  "old_line": 17,
+  "line": 21,
+  "before": [
+   [
+    13,
+    "const fixturePath = path.join(__dirname, \"../fixtures/v2-kuma.db.gz\");"
+   ],
+   [
+    14,
+    "const dataDir = path.join(__dirname, \"../../data/test-migration-v2-upgrade\");"
+   ],
+   [
+    15,
+    ""
+   ],
+   [
+    16,
+    "const username = \"admin\";"
+   ],
+   [
+    17,
+    "const password = \"Kuma-V2-Test-Password\";"
+   ],
+   [
+    18,
+    ""
+   ],
+   [
+    19,
+    "/**"
+   ],
+   [
+    20,
+    " * Get a free TCP port from the OS."
+   ],
+   [
+    21,
+    " * @returns {Promise<number>} A free port"
+   ]
+  ],
+  "before_line": 17,
+  "before_mapped": true,
+  "after": [
+   [
+    17,
+    ""
+   ],
+   [
+    18,
+    "const username = \"admin\";"
+   ],
+   [
+    19,
+    ""
+   ],
+   [
+    20,
+    "// A password that Have I Been Pwned reports as breached, to cover the migration path from #7946."
+   ],
+   [
+    21,
+    "const password = \"Admin123!x\";"
+   ],
+   [
+    22,
+    ""
+   ],
+   [
+    23,
+    "/**"
+   ],
+   [
+    24,
+    " * Get a free TCP port from the OS."
+   ],
+   [
+    25,
+    " * @returns {Promise<number>} A free port"
+   ]
+  ],
+  "diff": "@@ -7,6 +7,8 @@ import zlib from \"node:zlib\";\n import { spawn } from \"node:child_process\";\n import { fileURLToPath } from \"node:url\";\n import { io } from \"socket.io-client\";\n+import BetterSqlite3 from \"better-sqlite3\";\n+import bcrypt from \"bcryptjs\";\n\n const __dirname = path.dirname(fileURLToPath(import.meta.url));\n\n@@ -14,7 +16,9 @@ const fixturePath = path.join(__dirname, \"../fixtures/v2-kuma.db.gz\");\n const dataDir = path.join(__dirname, \"../../data/test-migration-v2-upgrade\");\n\n const username = \"admin\";\n-const password = \"Kuma-V2-Test-Password\";\n+\n+// A password that Have I Been Pwned reports as breached, to cover the migration path from #7946.\n+const password = \"Admin123!x\";\n\n /**\n  * Get a free TCP port from the OS."
+ },
+ {
+  "item": "F026",
+  "kind": "pair",
+  "repository": "securedrop",
+  "commit_url": "https://github.com/freedomofpress/securedrop/commit/db86920ded3273f0fec3f7cb7287817bf5167000",
+  "rule": "CG-SEC-002",
+  "rule_title": "Hardcoded secret",
+  "path": "securedrop/tests/test_journalist.py",
+  "old_path": "securedrop/tests/test_journalist.py",
+  "old_line": 1339,
+  "line": 1338,
+  "before": [
+   [
+    1335,
+    ""
+   ],
+   [
+    1336,
+    ""
+   ],
+   [
+    1337,
+    "def test_user_resets_hotp(journalist_app, test_journo):"
+   ],
+   [
+    1338,
+    "    old_secret = test_journo[\"otp_secret\"]"
+   ],
+   [
+    1339,
+    "    new_secret = \"0123456789ABCDEF0123456789ABCDEF01234567\""
+   ],
+   [
+    1340,
+    ""
+   ],
+   [
+    1341,
+    "    # Precondition"
+   ],
+   [
+    1342,
+    "    assert new_secret != old_secret"
+   ],
+   [
+    1343,
+    ""
+   ]
+  ],
+  "before_line": 1339,
+  "before_mapped": true,
+  "after": [
+   [
+    1334,
+    ""
+   ],
+   [
+    1335,
+    ""
+   ],
+   [
+    1336,
+    "def test_user_resets_hotp(journalist_app, test_journo):"
+   ],
+   [
+    1337,
+    "    old_secret = test_journo[\"otp_secret\"]"
+   ],
+   [
+    1338,
+    "    new_secret = \"0123456789ABCDEF0123456789ABCDEF01234567\""
+   ],
+   [
+    1339,
+    ""
+   ],
+   [
+    1340,
+    "    # Precondition"
+   ],
+   [
+    1341,
+    "    assert new_secret != old_secret"
+   ],
+   [
+    1342,
+    ""
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F027",
+  "kind": "introduced",
+  "repository": "netbox",
+  "commit_url": "https://github.com/netbox-community/netbox/commit/9d96894f4e1c622c25de40ccca5847efa5e15153",
+  "rule": "CG-SEC-001",
+  "rule_title": "SQL query built with string formatting",
+  "path": "netbox/utilities/tests/test_ltree.py",
+  "old_path": "netbox/utilities/tests/test_ltree.py",
+  "old_line": null,
+  "line": 1184,
+  "before": [
+   [
+    989,
+    "        self.assertEqual(len(sorted_rows), 2)"
+   ],
+   [
+    990,
+    "        self.assertEqual([r[0] for r in sorted_rows], [_path(1), _path(1, 2)])"
+   ],
+   [
+    991,
+    "        self.assertEqual([r[1] for r in sorted_rows], ['root', 'root\\tchild'])"
+   ],
+   [
+    992,
+    ""
+   ],
+   [
+    993,
+    "        self.assertEqual(len(plain_rows), 2)"
+   ],
+   [
+    994,
+    "        self.assertEqual([r[0] for r in plain_rows], [_path(1), _path(1, 2)])"
+   ],
+   [
+    995,
+    ""
+   ]
+  ],
+  "before_line": 995,
+  "before_mapped": false,
+  "after": [
+   [
+    1180,
+    ""
+   ],
+   [
+    1181,
+    "    def drop_cascade_trigger(self):"
+   ],
+   [
+    1182,
+    "        \"\"\"Leave the table as a database restored from a v4.7.0 dump: no cascade trigger.\"\"\""
+   ],
+   [
+    1183,
+    "        with connection.cursor() as cursor:"
+   ],
+   [
+    1184,
+    "            cursor.execute(f'DROP TRIGGER IF EXISTS \"{self.TRIGGER}\" ON \"{self.TABLE}\"')"
+   ],
+   [
+    1185,
+    ""
+   ],
+   [
+    1186,
+    "    def install_v470_cascade_trigger(self):"
+   ],
+   [
+    1187,
+    "        \"\"\""
+   ],
+   [
+    1188,
+    "        Install the definition v4.7.0 shipped: bare ltree comparisons, which a dump cannot"
+   ]
+  ],
+  "diff": "@@ -992,3 +996,240 @@ class RestrictedSearchPathBackfillTests(TestCase):\n\n         self.assertEqual(len(plain_rows), 2)\n         self.assertEqual([r[0] for r in plain_rows], [_path(1), _path(1, 2)])\n+\n+\n+class RestoreUnderRestrictedSearchPathTests(TestCase):\n+    \"\"\"\n+    The generated trigger DDL must create with the ltree extension's schema off the\n+    search_path, because that is how pg_dump replays it: dumps begin with\n+    `set_config('search_path', '', false)` and schema-qualify every name they can.\n+\n+    `IS DISTINCT FROM` cannot be schema-qualified \u2014 it expands to the operand type's\n+    `=` operator, resolved at CREATE TRIGGER time \u2014 so comparing two ltree values in a\n+    WHEN clause produced a cascade trigger which silently failed to restore, leaving\n+    descendant paths to go stale on the next rename or reparent (#23130). Comparing\n+    `path::text` resolves `pg_catalog.text =` instead, which is always available.\n+\n+    The trigger functions are created with the extension's schema on the path: they\n+    legitimately declare `parent_path ltree`, and pg_dump schema-qualifies those\n+    declarations, so only the CREATE TRIGGER statements are under test here.\n+    \"\"\"\n+\n+    def _install_with_extension_off_path(self, schema, table, name_column):\n+        with connection.cursor() as cursor:\n+            cursor.execute(f'CREATE SCHEMA {schema}')\n+            columns = 'id bigint PRIMARY KEY, parent_id bigint, path ltree, name text'\n+            if name_column:\n+                columns += ', sort_path text'\n+            cursor.execute(f'SET LOCAL search_path = {schema}, public')\n+            cursor.execute(f'CREATE TABLE {schema}.{table} ({columns})')\n+\n+            statements = ltree_trigger_sql(table, name_column)\n+            functions = [s for s in statements if 'CREATE OR REPLACE FUNCTION' in s]\n+            triggers = [s for s in statements if 'CREATE TRIGGER' in s]\n+            self.assertEqual(len(functions), 2)\n+            self.assertEqual(len(triggers), 2)\n+\n+            # Pass an empty parameter list, as schema_editor.execute() does during a\n+            # migration: the function bodies double their literal percent signs for\n... (202 more lines)"
+ },
+ {
+  "item": "F028",
+  "kind": "introduced",
+  "repository": "intelowl",
+  "commit_url": "https://github.com/intelowlproject/IntelOwl/commit/80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "frontend/src/components/auth/utils/validator.jsx",
+  "old_path": "frontend/src/components/auth/utils/validator.jsx",
+  "old_line": null,
+  "line": 24,
+  "before": [
+   [
+    18,
+    "  const errors = {};"
+   ],
+   [
+    19,
+    "  if (!password) {"
+   ],
+   [
+    20,
+    "    errors.password = \"Required\";"
+   ],
+   [
+    21,
+    "  } else if (password.length < 12) {"
+   ],
+   [
+    22,
+    "    errors.password = \"Must be 12 characters or more\";"
+   ],
+   [
+    23,
+    "  } else if (!PASSWORD_REGEX.test(password)) {"
+   ],
+   [
+    24,
+    "    errors.password ="
+   ],
+   [
+    25,
+    "      \"The password is entirely numeric or contains special characters\";"
+   ],
+   [
+    26,
+    "  }"
+   ],
+   [
+    27,
+    "  return errors;"
+   ],
+   [
+    28,
+    "}"
+   ],
+   [
+    29,
+    ""
+   ],
+   [
+    30,
+    "export function UserFieldsValidator(field, value) {"
+   ]
+  ],
+  "before_line": 24,
+  "before_mapped": false,
+  "after": [
+   [
+    20,
+    "    errors.password = \"Required\";"
+   ],
+   [
+    21,
+    "  } else if (password.length < 12) {"
+   ],
+   [
+    22,
+    "    errors.password = \"Must be 12 characters or more\";"
+   ],
+   [
+    23,
+    "  } else if (!PASSWORD_REGEX.test(password)) {"
+   ],
+   [
+    24,
+    "    errors.password = \"The password cannot be entirely numeric\";"
+   ],
+   [
+    25,
+    "  }"
+   ],
+   [
+    26,
+    "  return errors;"
+   ],
+   [
+    27,
+    "}"
+   ],
+   [
+    28,
+    ""
+   ]
+  ],
+  "diff": "@@ -21,8 +21,7 @@ export function PasswordValidator(password) {\n   } else if (password.length < 12) {\n     errors.password = \"Must be 12 characters or more\";\n   } else if (!PASSWORD_REGEX.test(password)) {\n-    errors.password =\n-      \"The password is entirely numeric or contains special characters\";\n+    errors.password = \"The password cannot be entirely numeric\";\n   }\n   return errors;\n }\n"
+ },
+ {
+  "item": "F029",
+  "kind": "pair",
+  "repository": "readthedocs",
+  "commit_url": "https://github.com/readthedocs/readthedocs.org/commit/6b9919fd2891a30f9f75a99c81fd71d6f09bb821",
+  "rule": "CG-SEC-002",
+  "rule_title": "Hardcoded secret",
+  "path": "readthedocs/rtd_tests/tests/test_api.py",
+  "old_path": "readthedocs/rtd_tests/tests/test_api.py",
+  "old_line": 762,
+  "line": 759,
+  "before": [
+   [
+    758,
+    ""
+   ],
+   [
+    759,
+    "    def test_create_key_for_project_with_long_slug(self):"
+   ],
+   [
+    760,
+    "        user = get(User)"
+   ],
+   [
+    761,
+    "        project = get(Project, users=[user], slug=\"a\" * 60)"
+   ],
+   [
+    762,
+    "        build_api_key_obj, build_api_key = BuildAPIKey.objects.create_key(project)"
+   ],
+   [
+    763,
+    "        self.assertTrue(BuildAPIKey.objects.is_valid(build_api_key))"
+   ],
+   [
+    764,
+    "        self.assertEqual(build_api_key_obj.name, \"a\" * 50)"
+   ],
+   [
+    765,
+    ""
+   ],
+   [
+    766,
+    "    def test_revoke_build_api_key(self):"
+   ]
+  ],
+  "before_line": 762,
+  "before_mapped": true,
+  "after": [
+   [
+    755,
+    ""
+   ],
+   [
+    756,
+    "    def test_create_key_for_project_with_long_slug(self):"
+   ],
+   [
+    757,
+    "        user = get(User)"
+   ],
+   [
+    758,
+    "        project = get(Project, users=[user], slug=\"a\" * 60)"
+   ],
+   [
+    759,
+    "        build_api_key_obj, build_api_key = BuildAPIKey.objects.create_key(project)"
+   ],
+   [
+    760,
+    "        self.assertTrue(BuildAPIKey.objects.is_valid(build_api_key))"
+   ],
+   [
+    761,
+    "        self.assertEqual(build_api_key_obj.name, \"a\" * 50)"
+   ],
+   [
+    762,
+    ""
+   ],
+   [
+    763,
+    "    def test_revoke_build_api_key(self):"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F030",
+  "kind": "pair",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/fbfb7c909265301e0945f9bad49f5c68ae2a76da",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "arches/app/media/js/viewmodels/map-editor.js",
+  "old_path": "arches/app/media/js/viewmodels/map-editor.js",
+  "old_line": 358,
+  "line": 359,
+  "before": [
+   [
+    354,
+    "        map.jumpTo(camera);"
+   ],
+   [
+    355,
+    "    };"
+   ],
+   [
+    356,
+    ""
+   ],
+   [
+    357,
+    "    this.editGeoJSON = function (features, nodeId) {"
+   ],
+   [
+    358,
+    "        var geoJSONString = JSON.stringify("
+   ],
+   [
+    359,
+    "            {"
+   ],
+   [
+    360,
+    "                type: \"FeatureCollection\","
+   ],
+   [
+    361,
+    "                features: features,"
+   ],
+   [
+    362,
+    "            },"
+   ]
+  ],
+  "before_line": 358,
+  "before_mapped": true,
+  "after": [
+   [
+    355,
+    "        map.jumpTo(camera);"
+   ],
+   [
+    356,
+    "    };"
+   ],
+   [
+    357,
+    ""
+   ],
+   [
+    358,
+    "    this.editGeoJSON = function (features, nodeId) {"
+   ],
+   [
+    359,
+    "        var geoJSONString = JSON.stringify("
+   ],
+   [
+    360,
+    "            {"
+   ],
+   [
+    361,
+    "                type: \"FeatureCollection\","
+   ],
+   [
+    362,
+    "                features: features,"
+   ],
+   [
+    363,
+    "            },"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F031",
+  "kind": "pair",
+  "repository": "defectdojo",
+  "commit_url": "https://github.com/DefectDojo/django-DefectDojo/commit/7e2af4942cfddf89ecace7bffb35c0d006d76a53",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "dojo/static/dojo/js/metrics.js",
+  "old_path": "dojo/static/dojo/js/metrics.js",
+  "old_line": 836,
+  "line": 836,
+  "before": [
+   [
+    832,
+    "    var min = opts.min || 0;"
+   ],
+   [
+    833,
+    "    var range = max - min;"
+   ],
+   [
+    834,
+    "    var pct = range > 0 ? ((value - min) / range) * 100 : 0;"
+   ],
+   [
+    835,
+    "    var remaining = 100 - pct;"
+   ],
+   [
+    836,
+    "    var title = opts.title || '';"
+   ],
+   [
+    837,
+    "    var label = opts.label || '';"
+   ],
+   [
+    838,
+    ""
+   ],
+   [
+    839,
+    "    // Pick colour based on percentage"
+   ],
+   [
+    840,
+    "    var color;"
+   ]
+  ],
+  "before_line": 836,
+  "before_mapped": true,
+  "after": [
+   [
+    832,
+    "    var min = opts.min || 0;"
+   ],
+   [
+    833,
+    "    var range = max - min;"
+   ],
+   [
+    834,
+    "    var pct = range > 0 ? ((value - min) / range) * 100 : 0;"
+   ],
+   [
+    835,
+    "    var remaining = 100 - pct;"
+   ],
+   [
+    836,
+    "    var title = opts.title || '';"
+   ],
+   [
+    837,
+    "    var label = opts.label || '';"
+   ],
+   [
+    838,
+    ""
+   ],
+   [
+    839,
+    "    // Pick colour based on percentage"
+   ],
+   [
+    840,
+    "    var color;"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F032",
+  "kind": "pair",
+  "repository": "ckan",
+  "commit_url": "https://github.com/ckan/ckan/commit/fd309bc144f08505087d8b8d463aa8da296ba766",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "ckan/public/base/javascript/client.js",
+  "old_path": "ckan/public/base/javascript/client.js",
+  "old_line": 227,
+  "line": 226,
+  "before": [
+   [
+    223,
+    "      var packages = jQuery.trim(string).split('\\n');"
+   ],
+   [
+    224,
+    "      var parsed = [];"
+   ],
+   [
+    225,
+    ""
+   ],
+   [
+    226,
+    "      return jQuery.map(packages, function (pkg) {"
+   ],
+   [
+    227,
+    "        var parts = pkg.split('|');"
+   ],
+   [
+    228,
+    "        var id    = jQuery.trim(parts.pop() || '');"
+   ],
+   [
+    229,
+    "        var text  = jQuery.trim(parts.join('|') || '');"
+   ],
+   [
+    230,
+    "        return options && options.objects === true ? {id: id, text: text} : id;"
+   ],
+   [
+    231,
+    "      });"
+   ]
+  ],
+  "before_line": 227,
+  "before_mapped": true,
+  "after": [
+   [
+    222,
+    "      var packages = jQuery.trim(string).split('\\n');"
+   ],
+   [
+    223,
+    "      var parsed = [];"
+   ],
+   [
+    224,
+    ""
+   ],
+   [
+    225,
+    "      return jQuery.map(packages, function (pkg) {"
+   ],
+   [
+    226,
+    "        var parts = pkg.split('|');"
+   ],
+   [
+    227,
+    "        var id    = jQuery.trim(parts.pop() || '');"
+   ],
+   [
+    228,
+    "        var text  = jQuery.trim(parts.join('|') || '');"
+   ],
+   [
+    229,
+    "        return options && options.objects === true ? {id: id, text: text} : id;"
+   ],
+   [
+    230,
+    "      });"
+   ]
+  ],
+  "diff": "@@ -230,7 +229,6 @@\n         return options && options.objects === true ? {id: id, text: text} : id;\n       });\n     },\n-\n   });\n\n   ckan.sandbox.setup(function (instance) {\n"
+ },
+ {
+  "item": "F033",
+  "kind": "pair",
+  "repository": "nodebb",
+  "commit_url": "https://github.com/NodeBB/NodeBB/commit/9d122948cf783fc72c8c01c7aab0f42b2561b3c3",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "test/user.js",
+  "old_path": "test/user.js",
+  "old_line": 2384,
+  "line": 2415,
+  "before": [
+   [
+    2380,
+    "\t\t\t\tconst token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);"
+   ],
+   [
+    2381,
+    ""
+   ],
+   [
+    2382,
+    "\t\t\t\tconst { body } = await helpers.registerUser({"
+   ],
+   [
+    2383,
+    "\t\t\t\t\tusername: 'invite5',"
+   ],
+   [
+    2384,
+    "\t\t\t\t\tpassword: '123456',"
+   ],
+   [
+    2385,
+    "\t\t\t\t\t'password-confirm': '123456',"
+   ],
+   [
+    2386,
+    "\t\t\t\t\temail: email,"
+   ],
+   [
+    2387,
+    "\t\t\t\t\tgdpr_consent: true,"
+   ],
+   [
+    2388,
+    "\t\t\t\t\ttoken: token,"
+   ]
+  ],
+  "before_line": 2384,
+  "before_mapped": true,
+  "after": [
+   [
+    2411,
+    "\t\t\t\tconst token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);"
+   ],
+   [
+    2412,
+    ""
+   ],
+   [
+    2413,
+    "\t\t\t\tconst { body } = await helpers.registerUser({"
+   ],
+   [
+    2414,
+    "\t\t\t\t\tusername: 'invite5',"
+   ],
+   [
+    2415,
+    "\t\t\t\t\tpassword: '123456',"
+   ],
+   [
+    2416,
+    "\t\t\t\t\t'password-confirm': '123456',"
+   ],
+   [
+    2417,
+    "\t\t\t\t\temail: email,"
+   ],
+   [
+    2418,
+    "\t\t\t\t\tgdpr_consent: true,"
+   ],
+   [
+    2419,
+    "\t\t\t\t\ttoken: token,"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F034",
+  "kind": "pair",
+  "repository": "securedrop",
+  "commit_url": "https://github.com/freedomofpress/securedrop/commit/871378be59567ac2916c1ae5d8f347784288d46f",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "securedrop/tests/test_journalist_api2.py",
+  "old_path": "securedrop/tests/test_journalist_api2.py",
+  "old_line": 738,
+  "line": 738,
+  "before": [
+   [
+    734,
+    "        )"
+   ],
+   [
+    735,
+    "        assert response.json[\"events\"][stale_event.id] == [200, None]"
+   ],
+   [
+    736,
+    ""
+   ],
+   [
+    737,
+    ""
+   ],
+   [
+    738,
+    "def test_api2_source_deleted("
+   ],
+   [
+    739,
+    "    journalist_app,"
+   ],
+   [
+    740,
+    "    journalist_api_token,"
+   ],
+   [
+    741,
+    "    test_files,"
+   ],
+   [
+    742,
+    "):"
+   ]
+  ],
+  "before_line": 738,
+  "before_mapped": true,
+  "after": [
+   [
+    734,
+    "        )"
+   ],
+   [
+    735,
+    "        assert response.json[\"events\"][stale_event.id] == [200, None]"
+   ],
+   [
+    736,
+    ""
+   ],
+   [
+    737,
+    ""
+   ],
+   [
+    738,
+    "def test_api2_source_deleted("
+   ],
+   [
+    739,
+    "    journalist_app,"
+   ],
+   [
+    740,
+    "    journalist_api_token,"
+   ],
+   [
+    741,
+    "    test_files,"
+   ],
+   [
+    742,
+    "):"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F035",
+  "kind": "introduced",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/863b1b29a803f6c456b04dd82d19a53c7afc9102",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "packages/hoppscotch-common/src/lib/sync/collections/index.ts",
+  "old_path": "packages/hoppscotch-selfhost-web/src/platform/collections/desktop/index.ts",
+  "old_line": null,
+  "line": 511,
+  "before": [
+   [
+    486,
+    "      }"
+   ],
+   [
+    487,
+    ""
+   ],
+   [
+    488,
+    "      // updated collection is a root collection"
+   ],
+   [
+    489,
+    "      if (updatedCollectionLocalPath && !isFolder) {"
+   ],
+   [
+    490,
+    "        runDispatchWithOutSyncing(() => {"
+   ],
+   [
+    491,
+    "          collectionType == \"REST\""
+   ],
+   [
+    492,
+    "            ? editRESTCollection(parseInt(updatedCollectionLocalPath), {"
+   ],
+   [
+    493,
+    "                name: res.right.userCollectionUpdated.title,"
+   ],
+   [
+    494,
+    "              })"
+   ],
+   [
+    495,
+    "            : editGraphqlCollection(parseInt(updatedCollectionLocalPath), {"
+   ],
+   [
+    496,
+    "                name: res.right.userCollectionUpdated.title,"
+   ],
+   [
+    497,
+    "              })"
+   ],
+   [
+    498,
+    "        })"
+   ]
+  ],
+  "before_line": 492,
+  "before_mapped": false,
+  "after": [
+   [
+    507,
+    "          collectionType == \"REST\""
+   ],
+   [
+    508,
+    "            ? editRESTFolder(updatedCollectionLocalPath, partialUpdate)"
+   ],
+   [
+    509,
+    "            : editGraphqlFolder(updatedCollectionLocalPath, partialUpdate)"
+   ],
+   [
+    510,
+    "        } else {"
+   ],
+   [
+    511,
+    "          collectionType == \"REST\""
+   ],
+   [
+    512,
+    "            ? editRESTCollection("
+   ],
+   [
+    513,
+    "                parseInt(updatedCollectionLocalPath),"
+   ],
+   [
+    514,
+    "                partialUpdate"
+   ],
+   [
+    515,
+    "              )"
+   ]
+  ],
+  "diff": "@@ -458,45 +454,71 @@ function setupUserCollectionUpdatedSubscription() {\n\n   userCollectionUpdated$.subscribe((res) => {\n     if (E.isRight(res)) {\n-      const collectionType = res.right.userCollectionUpdated.type\n+      const {\n+        id: updatedCollectionBackendID,\n+        title,\n+        type: collectionType,\n+        data,\n+      } = res.right.userCollectionUpdated\n\n       const { collectionStore } = getStoreByCollectionType(collectionType)\n\n-      const updatedCollectionBackendID = res.right.userCollectionUpdated.id\n       const updatedCollectionLocalPath = getCollectionPathFromCollectionID(\n         updatedCollectionBackendID,\n         collectionStore.value.state\n       )\n\n-      const isFolder =\n-        updatedCollectionLocalPath &&\n-        updatedCollectionLocalPath.split(\"/\").length > 1\n+      if (!updatedCollectionLocalPath) return\n\n-      // updated collection is a folder\n-      if (isFolder) {\n-        runDispatchWithOutSyncing(() => {\n-          collectionType == \"REST\"\n-            ? editRESTFolder(updatedCollectionLocalPath, {\n-                name: res.right.userCollectionUpdated.title,\n-              })\n-            : editGraphqlFolder(updatedCollectionLocalPath, {\n-                name: res.right.userCollectionUpdated.title,\n-              })\n-        })\n+      const isFolder = updatedCollectionLocalPath.split(\"/\").length > 1\n+\n+      // Carry auth, headers, variables, and scripts from the data payload\n+      const {\n... (59 more lines)"
+ },
+ {
+  "item": "F036",
+  "kind": "introduced",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/0d164da8ddc68474300dc85677856950ef81ee7e",
+  "rule": "CG-QUAL-103",
+  "rule_title": "Function is too complex",
+  "path": "apps/web/playwright/fixtures/users.ts",
+  "old_path": "apps/web/playwright/fixtures/users.ts",
+  "old_line": null,
+  "line": 813,
+  "before": [
+   [
+    807,
+    "  password?: string | null;"
+   ],
+   [
+    808,
+    "  emailDomain?: string;"
+   ],
+   [
+    809,
+    "  profileUsername?: string;"
+   ],
+   [
+    810,
+    "};"
+   ],
+   [
+    811,
+    ""
+   ],
+   [
+    812,
+    "// creates the actual user in the db."
+   ],
+   [
+    813,
+    "const createUser = ("
+   ],
+   [
+    814,
+    "  workerInfo: WorkerInfo,"
+   ],
+   [
+    815,
+    "  opts?:"
+   ],
+   [
+    816,
+    "    | (CustomUserOpts & {"
+   ],
+   [
+    817,
+    "        organizationId?: number | null;"
+   ],
+   [
+    818,
+    "      })"
+   ],
+   [
+    819,
+    "    | null"
+   ]
+  ],
+  "before_line": 813,
+  "before_mapped": true,
+  "after": [
+   [
+    809,
+    "  profileUsername?: string;"
+   ],
+   [
+    810,
+    "};"
+   ],
+   [
+    811,
+    ""
+   ],
+   [
+    812,
+    "// creates the actual user in the db."
+   ],
+   [
+    813,
+    "const createUser = ("
+   ],
+   [
+    814,
+    "  workerInfo: WorkerInfo,"
+   ],
+   [
+    815,
+    "  opts?:"
+   ],
+   [
+    816,
+    "    | (CustomUserOpts & {"
+   ],
+   [
+    817,
+    "        organizationId?: number | null;"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F037",
+  "kind": "pair",
+  "repository": "documenso",
+  "commit_url": "https://github.com/documenso/documenso/commit/97835b8dbb2ca24670c8a410972d949c982c8f61",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/app-tests/e2e/envelope-editor-v2/envelope-fields.spec.ts",
+  "old_path": "packages/app-tests/e2e/envelope-editor-v2/envelope-fields.spec.ts",
+  "old_line": 1000,
+  "line": 1149,
+  "before": [
+   [
+    996,
+    "  test('place and configure all 10 field types', async ({ page }) => {"
+   ],
+   [
+    997,
+    "    const surface = await openEmbeddedEnvelopeEditor(page, {"
+   ],
+   [
+    998,
+    "      envelopeType: 'TEMPLATE',"
+   ],
+   [
+    999,
+    "      mode: 'edit',"
+   ],
+   [
+    1000,
+    "      tokenNamePrefix: 'e2e-embed-all-fields',"
+   ],
+   [
+    1001,
+    "    });"
+   ],
+   [
+    1002,
+    "    const result = await runAllFieldTypesFlow(surface);"
+   ],
+   [
+    1003,
+    ""
+   ],
+   [
+    1004,
+    "    await persistEmbeddedEnvelope(surface);"
+   ]
+  ],
+  "before_line": 1000,
+  "before_mapped": true,
+  "after": [
+   [
+    1145,
+    "  test('place and configure all 10 field types', async ({ page }) => {"
+   ],
+   [
+    1146,
+    "    const surface = await openEmbeddedEnvelopeEditor(page, {"
+   ],
+   [
+    1147,
+    "      envelopeType: 'TEMPLATE',"
+   ],
+   [
+    1148,
+    "      mode: 'edit',"
+   ],
+   [
+    1149,
+    "      tokenNamePrefix: 'e2e-embed-all-fields',"
+   ],
+   [
+    1150,
+    "    });"
+   ],
+   [
+    1151,
+    "    const result = await runAllFieldTypesFlow(surface);"
+   ],
+   [
+    1152,
+    ""
+   ],
+   [
+    1153,
+    "    await persistEmbeddedEnvelope(surface);"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F038",
+  "kind": "pair",
+  "repository": "nodebb",
+  "commit_url": "https://github.com/NodeBB/NodeBB/commit/b8d9cf9d1ee03115d28b3548911e9076a275311a",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "test/user.js",
+  "old_path": "test/user.js",
+  "old_line": 2318,
+  "line": 2335,
+  "before": [
+   [
+    2314,
+    "\t\t\t\tconst token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);"
+   ],
+   [
+    2315,
+    ""
+   ],
+   [
+    2316,
+    "\t\t\t\tconst { body } = await helpers.registerUser({"
+   ],
+   [
+    2317,
+    "\t\t\t\t\tusername: 'invite5',"
+   ],
+   [
+    2318,
+    "\t\t\t\t\tpassword: '123456',"
+   ],
+   [
+    2319,
+    "\t\t\t\t\t'password-confirm': '123456',"
+   ],
+   [
+    2320,
+    "\t\t\t\t\temail: email,"
+   ],
+   [
+    2321,
+    "\t\t\t\t\tgdpr_consent: true,"
+   ],
+   [
+    2322,
+    "\t\t\t\t\ttoken: token,"
+   ]
+  ],
+  "before_line": 2318,
+  "before_mapped": true,
+  "after": [
+   [
+    2331,
+    "\t\t\t\tconst token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);"
+   ],
+   [
+    2332,
+    ""
+   ],
+   [
+    2333,
+    "\t\t\t\tconst { body } = await helpers.registerUser({"
+   ],
+   [
+    2334,
+    "\t\t\t\t\tusername: 'invite5',"
+   ],
+   [
+    2335,
+    "\t\t\t\t\tpassword: '123456',"
+   ],
+   [
+    2336,
+    "\t\t\t\t\t'password-confirm': '123456',"
+   ],
+   [
+    2337,
+    "\t\t\t\t\temail: email,"
+   ],
+   [
+    2338,
+    "\t\t\t\t\tgdpr_consent: true,"
+   ],
+   [
+    2339,
+    "\t\t\t\t\ttoken: token,"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F039",
+  "kind": "pair",
+  "repository": "geonode",
+  "commit_url": "https://github.com/GeoNode/geonode/commit/e653caf78f3567996934967448a7e959db44236e",
+  "rule": "CG-QUAL-002",
+  "rule_title": "Exception silently swallowed",
+  "path": "geonode/utils.py",
+  "old_path": "geonode/utils.py",
+  "old_line": 377,
+  "line": 377,
+  "before": [
+   [
+    373,
+    "            if \":\" in dataset.alternate:"
+   ],
+   [
+    374,
+    "                _name = dataset.alternate.split(\":\")[1]"
+   ],
+   [
+    375,
+    "            else:"
+   ],
+   [
+    376,
+    "                _name = dataset.alternate"
+   ],
+   [
+    377,
+    "    except Exception:"
+   ],
+   [
+    378,
+    "        pass"
+   ],
+   [
+    379,
+    "    return _name"
+   ],
+   [
+    380,
+    ""
+   ],
+   [
+    381,
+    ""
+   ]
+  ],
+  "before_line": 377,
+  "before_mapped": true,
+  "after": [
+   [
+    373,
+    "            if \":\" in dataset.alternate:"
+   ],
+   [
+    374,
+    "                _name = dataset.alternate.split(\":\")[1]"
+   ],
+   [
+    375,
+    "            else:"
+   ],
+   [
+    376,
+    "                _name = dataset.alternate"
+   ],
+   [
+    377,
+    "    except Exception:"
+   ],
+   [
+    378,
+    "        pass"
+   ],
+   [
+    379,
+    "    return _name"
+   ],
+   [
+    380,
+    ""
+   ],
+   [
+    381,
+    ""
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F040",
+  "kind": "pair",
+  "repository": "erpnext",
+  "commit_url": "https://github.com/frappe/erpnext/commit/ddc764b3608610fa659dd722da44e115850cc4da",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "erpnext/stock/doctype/material_request/material_request.js",
+  "old_path": "erpnext/stock/doctype/material_request/material_request.js",
+  "old_line": 810,
+  "line": 809,
+  "before": [
+   [
+    806,
+    "\t\t\t\tdoc.material_request_type == \"Purchase\" ||"
+   ],
+   [
+    807,
+    "\t\t\t\tdoc.material_request_type == \"Subcontracting\""
+   ],
+   [
+    808,
+    "\t\t\t) {"
+   ],
+   [
+    809,
+    "\t\t\t\tfilters = { is_purchase_item: 1 };"
+   ],
+   [
+    810,
+    "\t\t\t} else if (doc.material_request_type == \"Manufacture\") {"
+   ],
+   [
+    811,
+    "\t\t\t\tfilters.include_item_in_manufacturing = 1;"
+   ],
+   [
+    812,
+    "\t\t\t}"
+   ],
+   [
+    813,
+    ""
+   ],
+   [
+    814,
+    "\t\t\treturn {"
+   ]
+  ],
+  "before_line": 810,
+  "before_mapped": true,
+  "after": [
+   [
+    805,
+    "\t\t\t} else if (doc.material_request_type == \"Purchase\") {"
+   ],
+   [
+    806,
+    "\t\t\t\tfilters = { is_purchase_item: 1 };"
+   ],
+   [
+    807,
+    "\t\t\t} else if (doc.material_request_type == \"Subcontracting\") {"
+   ],
+   [
+    808,
+    "\t\t\t\tfilters = { is_stock_item: 1, is_sub_contracted_item: 1 };"
+   ],
+   [
+    809,
+    "\t\t\t} else if (doc.material_request_type == \"Manufacture\") {"
+   ],
+   [
+    810,
+    "\t\t\t\tfilters.include_item_in_manufacturing = 1;"
+   ],
+   [
+    811,
+    "\t\t\t}"
+   ],
+   [
+    812,
+    ""
+   ],
+   [
+    813,
+    "\t\t\treturn {"
+   ]
+  ],
+  "diff": "@@ -802,11 +802,10 @@ erpnext.buying.MaterialRequestController = class MaterialRequestController exten\n\n \t\t\tif (doc.material_request_type == \"Customer Provided\") {\n \t\t\t\tfilters.customer = doc.customer;\n-\t\t\t} else if (\n-\t\t\t\tdoc.material_request_type == \"Purchase\" ||\n-\t\t\t\tdoc.material_request_type == \"Subcontracting\"\n-\t\t\t) {\n+\t\t\t} else if (doc.material_request_type == \"Purchase\") {\n \t\t\t\tfilters = { is_purchase_item: 1 };\n+\t\t\t} else if (doc.material_request_type == \"Subcontracting\") {\n+\t\t\t\tfilters = { is_stock_item: 1, is_sub_contracted_item: 1 };\n \t\t\t} else if (doc.material_request_type == \"Manufacture\") {\n \t\t\t\tfilters.include_item_in_manufacturing = 1;\n \t\t\t}\n"
+ },
+ {
+  "item": "F041",
+  "kind": "introduced",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "arches/app/media/js/views/graph/permission-designer.js",
+  "old_path": "arches/app/media/js/views/graph/permission-designer.js",
+  "old_line": null,
+  "line": 148,
+  "before": [
+   [
+    113,
+    "                            }"
+   ],
+   [
+    114,
+    "                        });"
+   ],
+   [
+    115,
+    "                    }"
+   ],
+   [
+    116,
+    "                });"
+   ],
+   [
+    117,
+    "            }"
+   ],
+   [
+    118,
+    "        };"
+   ],
+   [
+    119,
+    "    };"
+   ],
+   [
+    120,
+    ""
+   ],
+   [
+    121,
+    "    export default PermissionDesignerViewModel;"
+   ],
+   [
+    122,
+    "    /**"
+   ],
+   [
+    123,
+    "    * a GraphPageView representing the graph manager page"
+   ],
+   [
+    124,
+    "    */"
+   ],
+   [
+    125,
+    "    // var graphPageView = new GraphPageView({"
+   ]
+  ],
+  "before_line": 119,
+  "before_mapped": false,
+  "after": [
+   [
+    144,
+    "                .done(function(res) {"
+   ],
+   [
+    145,
+    "                    var byNodegroup = {};"
+   ],
+   [
+    146,
+    "                    res.forEach(function(nodegroup) {"
+   ],
+   [
+    147,
+    "                        byNodegroup[nodegroup.nodegroup_id] = nodegroup;"
+   ],
+   [
+    148,
+    "                        var card = _.find(self.cardList, function(card) {"
+   ],
+   [
+    149,
+    "                            return card.model.nodegroup_id() === nodegroup.nodegroup_id;"
+   ],
+   [
+    150,
+    "                        });"
+   ],
+   [
+    151,
+    "                        if (!card) {"
+   ],
+   [
+    152,
+    "                            return;"
+   ]
+  ],
+  "diff": "@@ -70,62 +99,82 @@ import PermissionSettingsForm from 'views/graph/permission-manager/permission-se\n                         self.updatePermissions();\n                     });\n                 })\n-                .fail(function(err) {\n-                    console.log(err);\n+                .fail(function(response) {\n+                    showError(response.responseJSON, arches.translations.graphDesignerPermissionsLoadError);\n+                })\n+                .always(function() {\n+                    self.loading(false);\n                 });\n         };\n\n+        var setCardPerms = function(card, perms, literal) {\n+            card.perms(perms);\n+            card.permsLiteral(literal);\n+            if (card.type === 'card' && card.children && card.children.length > 0) {\n+                card.children.forEach(function(child) {\n+                    if (child.type === 'node' && child.perms) {\n+                        child.perms(perms);\n+                    }\n+                });\n+            }\n+        };\n+\n         this.updatePermissions = function() {\n-            var item = self.identityList.selectedItems()[0];\n-            var nodegroupIds = [];\n+            var identity = self.identityList.selectedItems()[0];\n\n-            if (item) {\n-                self.cardList.forEach(function(item) {\n-                    nodegroupIds.push(item.model.nodegroup_id());\n+            if (!identity || !self.cardList) {\n+                self.permissionsByNodegroup({});\n+                (self.cardList || []).forEach(function(card) {\n+                    setCardPerms(card, [], '');\n                 });\n-                $.ajax({\n... (91 more lines)"
+ },
+ {
+  "item": "F042",
+  "kind": "introduced",
+  "repository": "netbox",
+  "commit_url": "https://github.com/netbox-community/netbox/commit/8cc4548e1f51fcd4cb63299339b55e5ef179e28a",
+  "rule": "CG-SEC-001",
+  "rule_title": "SQL query built with string formatting",
+  "path": "netbox/utilities/ltree.py",
+  "old_path": "netbox/utilities/ltree.py",
+  "old_line": null,
+  "line": 287,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    283,
+    "            schema_editor.execute(_AFTER_TRIGGER_PATH_ONLY.format(table=self.table_name))"
+   ],
+   [
+    284,
+    ""
+   ],
+   [
+    285,
+    "    def database_backwards(self, app_label, schema_editor, from_state, to_state):"
+   ],
+   [
+    286,
+    "        t = self.table_name"
+   ],
+   [
+    287,
+    "        schema_editor.execute(f'DROP TRIGGER IF EXISTS \"{t}_ltree_cascade_path\" ON \"{t}\";')"
+   ],
+   [
+    288,
+    "        schema_editor.execute(f'DROP TRIGGER IF EXISTS \"{t}_ltree_compute_path\" ON \"{t}\";')"
+   ],
+   [
+    289,
+    "        schema_editor.execute(f'DROP FUNCTION IF EXISTS \"{t}_ltree_cascade_path_fn\"();')"
+   ],
+   [
+    290,
+    "        schema_editor.execute(f'DROP FUNCTION IF EXISTS \"{t}_ltree_compute_path_fn\"();')"
+   ],
+   [
+    291,
+    ""
+   ]
+  ],
+  "diff": "@@ -0,0 +1,293 @@\n+\"\"\"\n+Migration support for ltree-based hierarchical models.\n+\n+This module holds the schema-level machinery that backs `netbox.models.ltree`:\n+the PostgreSQL trigger function / trigger SQL and the `InstallLtreeTriggers`\n+migration operation that installs them. It is kept separate from the model layer\n+(`netbox.models.ltree`) so that migrations depend only on this DB-level code and\n+not on the model definitions.\n+\n+The paths maintained by these triggers are never computed or mutated from Python;\n+the model layer only reads `path`/`sort_path` back from the database.\n+\"\"\"\n+from django.db import migrations\n+\n+__all__ = (\n+    'InstallLtreeTriggers',\n+)\n+\n+\n+# Path label is the row's PK zero-padded to 19 chars (max bigint width) so that\n+# lexicographic ordering of ltree labels matches numeric PK ordering across digit\n+# boundaries (e.g. \"0...09\" sorts before \"0...10\").\n+# Per-tree advisory locking (see _lock_tree_roots_sql / LtreeModel \"Concurrency\"):\n+# every child insert / move / reparent of a node takes a transaction-level\n+# advisory lock keyed on the root(s) of the tree(s) it touches, BEFORE reading the\n+# parent path. A concurrent reparent of an ancestor takes the same key, so the two\n+# serialize and the AFTER cascade can never miss a row inserted concurrently;\n+# writes in different trees use different keys and run in parallel. Inserting a new\n+# root (parent_id IS NULL) takes no lock at all -- it is a race-free singleton tree\n+# -- so a bulk import of many top-level objects does not accumulate one lock per\n+# root and cannot exhaust the shared lock table.\n+_LOCK_TREE_ROOTS_SQL = '''\n+    -- A brand-new root (INSERT with parent_id IS NULL) starts its own singleton\n+    -- tree that no concurrent transaction can yet see (MVCC: the uncommitted row\n+    -- is invisible) or reference (no other transaction has its PK). For such a\n+    -- row this BEFORE function reads no other row (the parent lookup below is\n+    -- gated on parent_id) and the AFTER cascade fires only on UPDATE, so the\n+    -- insert touches solely its own NEW row -- there is nothing to serialize\n+    -- against, and the advisory lock it would otherwise take can never contend.\n... (255 more lines)"
+ },
+ {
+  "item": "F043",
+  "kind": "pair",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/1855faabbc4ff968d874f54510f6c586a7fdae05",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "packages/hoppscotch-common/src/lib/sync/collections/index.ts",
+  "old_path": "packages/hoppscotch-common/src/lib/sync/collections/index.ts",
+  "old_line": 796,
+  "line": 799,
+  "before": [
+   [
+    792,
+    "        description,"
+   ],
+   [
+    793,
+    "        preRequestScript,"
+   ],
+   [
+    794,
+    "        testScript,"
+   ],
+   [
+    795,
+    "      } ="
+   ],
+   [
+    796,
+    "        data && data != \"null\""
+   ],
+   [
+    797,
+    "          ? JSON.parse(data)"
+   ],
+   [
+    798,
+    "          : {"
+   ],
+   [
+    799,
+    "              auth: { authType: \"inherit\", authActive: true },"
+   ],
+   [
+    800,
+    "              headers: [],"
+   ]
+  ],
+  "before_line": 796,
+  "before_mapped": true,
+  "after": [
+   [
+    795,
+    "        description,"
+   ],
+   [
+    796,
+    "        preRequestScript,"
+   ],
+   [
+    797,
+    "        testScript,"
+   ],
+   [
+    798,
+    "      } ="
+   ],
+   [
+    799,
+    "        data && data != \"null\""
+   ],
+   [
+    800,
+    "          ? JSON.parse(data)"
+   ],
+   [
+    801,
+    "          : {"
+   ],
+   [
+    802,
+    "              auth: { authType: \"inherit\", authActive: true },"
+   ],
+   [
+    803,
+    "              headers: [],"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F044",
+  "kind": "pair",
+  "repository": "pgadmin",
+  "commit_url": "https://github.com/pgadmin-org/pgadmin4/commit/5f56805162c117ac1de17368ef8fdc0b07221e2c",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx",
+  "old_path": "web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx",
+  "old_line": 713,
+  "line": 749,
+  "before": [
+   [
+    709,
+    "        for (const connItem of newConnList) {"
+   ],
+   [
+    710,
+    "          if(newConnData.sid == connItem.sid"
+   ],
+   [
+    711,
+    "            && newConnData.did == connItem.did"
+   ],
+   [
+    712,
+    "            && newConnData.user == connItem.user"
+   ],
+   [
+    713,
+    "            && newConnData.role == connItem.role) {"
+   ],
+   [
+    714,
+    "            connItem.is_selected = true;"
+   ],
+   [
+    715,
+    "          } else {"
+   ],
+   [
+    716,
+    "            connItem.is_selected = false;"
+   ],
+   [
+    717,
+    "          }"
+   ]
+  ],
+  "before_line": 713,
+  "before_mapped": true,
+  "after": [
+   [
+    745,
+    "        for (const connItem of newConnList) {"
+   ],
+   [
+    746,
+    "          if(newConnData.sid == connItem.sid"
+   ],
+   [
+    747,
+    "            && newConnData.did == connItem.did"
+   ],
+   [
+    748,
+    "            && newConnData.user == connItem.user"
+   ],
+   [
+    749,
+    "            && (newConnData.role || null) == (connItem.role || null)) {"
+   ],
+   [
+    750,
+    "            connItem.is_selected = true;"
+   ],
+   [
+    751,
+    "          } else {"
+   ],
+   [
+    752,
+    "            connItem.is_selected = false;"
+   ],
+   [
+    753,
+    "          }"
+   ]
+  ],
+  "diff": "@@ -702,15 +735,18 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN\n     const selectConn = (newConnData, connected=false, obtainingConn=true)=>{\n       setQtStatePartial((prevQtState)=>{\n         let newConnList = [...prevQtState.connection_list];\n-        /* If new, add to the list */\n-        if(isNew) {\n+        /* If new, add to the list if not already present */\n+        if(isNew && !newConnList.some((c)=>c.sid == newConnData.sid\n+          && c.did == newConnData.did\n+          && c.user == newConnData.user\n+          && (c.role || null) == (newConnData.role || null))) {\n           newConnList.push(newConnData);\n         }\n         for (const connItem of newConnList) {\n           if(newConnData.sid == connItem.sid\n             && newConnData.did == connItem.did\n             && newConnData.user == connItem.user\n-            && newConnData.role == connItem.role) {\n+            && (newConnData.role || null) == (connItem.role || null)) {\n             connItem.is_selected = true;\n           } else {\n             connItem.is_selected = false;"
+ },
+ {
+  "item": "F045",
+  "kind": "pair",
+  "repository": "habitica",
+  "commit_url": "https://github.com/HabitRPG/habitica/commit/78c62a5aec6f6270ff432de6fdb6efb0e120526d",
+  "rule": "CG-SEC-111",
+  "rule_title": "Deep merge of request data (prototype pollution)",
+  "path": "website/server/controllers/api-v3/tasks.js",
+  "old_path": "website/server/controllers/api-v3/tasks.js",
+  "old_line": 1017,
+  "line": 1018,
+  "before": [
+   [
+    1013,
+    ""
+   ],
+   [
+    1014,
+    "    const item = find(task.checklist, { id: req.params.itemId });"
+   ],
+   [
+    1015,
+    "    if (!item) throw new NotFound(res.t('checklistItemNotFound'));"
+   ],
+   [
+    1016,
+    ""
+   ],
+   [
+    1017,
+    "    merge(item, Tasks.Task.sanitizeChecklist(req.body));"
+   ],
+   [
+    1018,
+    "    const savedTask = await task.save();"
+   ],
+   [
+    1019,
+    ""
+   ],
+   [
+    1020,
+    "    res.respond(200, savedTask);"
+   ],
+   [
+    1021,
+    "    if (challenge) challenge.updateTask(savedTask);"
+   ]
+  ],
+  "before_line": 1017,
+  "before_mapped": true,
+  "after": [
+   [
+    1014,
+    ""
+   ],
+   [
+    1015,
+    "    const item = find(task.checklist, { id: req.params.itemId });"
+   ],
+   [
+    1016,
+    "    if (!item) throw new NotFound(res.t('checklistItemNotFound'));"
+   ],
+   [
+    1017,
+    ""
+   ],
+   [
+    1018,
+    "    merge(item, Tasks.Task.sanitizeChecklist(req.body));"
+   ],
+   [
+    1019,
+    "    const savedTask = await task.save();"
+   ],
+   [
+    1020,
+    ""
+   ],
+   [
+    1021,
+    "    res.respond(200, savedTask);"
+   ],
+   [
+    1022,
+    "    if (challenge) challenge.updateTask(savedTask);"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F046",
+  "kind": "pair",
+  "repository": "inventree",
+  "commit_url": "https://github.com/inventree/InvenTree/commit/02da01dfec309ac410e846a57d329d0e96b90e21",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "src/frontend/src/pages/stock/TransferOrderDetail.tsx",
+  "old_path": "src/frontend/src/pages/stock/TransferOrderDetail.tsx",
+  "old_line": 160,
+  "line": 166,
+  "before": [
+   [
+    156,
+    "          order.status != toStatus.COMPLETE"
+   ],
+   [
+    157,
+    "            ? t`Allocated Stock`"
+   ],
+   [
+    158,
+    "            : t`Transferred Stock`,"
+   ],
+   [
+    159,
+    "        icon:"
+   ],
+   [
+    160,
+    "          order.status != toStatus.COMPLETE ? ("
+   ],
+   [
+    161,
+    "            <IconBookmark />"
+   ],
+   [
+    162,
+    "          ) : ("
+   ],
+   [
+    163,
+    "            <IconListCheck />"
+   ],
+   [
+    164,
+    "          ),"
+   ]
+  ],
+  "before_line": 160,
+  "before_mapped": true,
+  "after": [
+   [
+    162,
+    "          order.status != toStatus.COMPLETE"
+   ],
+   [
+    163,
+    "            ? t`Allocated Stock`"
+   ],
+   [
+    164,
+    "            : t`Transferred Stock`,"
+   ],
+   [
+    165,
+    "        icon:"
+   ],
+   [
+    166,
+    "          order.status != toStatus.COMPLETE ? ("
+   ],
+   [
+    167,
+    "            <IconBookmark />"
+   ],
+   [
+    168,
+    "          ) : ("
+   ],
+   [
+    169,
+    "            <IconListCheck />"
+   ],
+   [
+    170,
+    "          ),"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F047",
+  "kind": "pair",
+  "repository": "habitica",
+  "commit_url": "https://github.com/HabitRPG/habitica/commit/e6ffd69148396eeff7130b102a93d774fa11dcbc",
+  "rule": "CG-QUAL-103",
+  "rule_title": "Function is too complex",
+  "path": "website/common/script/ops/buy/hourglassPurchase.js",
+  "old_path": "website/common/script/ops/buy/hourglassPurchase.js",
+  "old_line": 16,
+  "line": 15,
+  "before": [
+   [
+    12,
+    "import getItemInfo from '../../libs/getItemInfo';"
+   ],
+   [
+    13,
+    "import { removeItemByPath } from '../pinnedGearUtils';"
+   ],
+   [
+    14,
+    "import updateUserHourglasses from '../updateUserHourglasses';"
+   ],
+   [
+    15,
+    ""
+   ],
+   [
+    16,
+    "export default async function purchaseHourglass (user, req = {}, analytics, quantity = 1) {"
+   ],
+   [
+    17,
+    "  const key = get(req, 'params.key');"
+   ],
+   [
+    18,
+    "  if (!key) throw new BadRequest(errorMessage('missingKeyParam'));"
+   ],
+   [
+    19,
+    ""
+   ],
+   [
+    20,
+    "  const type = get(req, 'params.type');"
+   ]
+  ],
+  "before_line": 16,
+  "before_mapped": true,
+  "after": [
+   [
+    11,
+    "import getItemInfo from '../../libs/getItemInfo';"
+   ],
+   [
+    12,
+    "import { removeItemByPath } from '../pinnedGearUtils';"
+   ],
+   [
+    13,
+    "import updateUserHourglasses from '../updateUserHourglasses';"
+   ],
+   [
+    14,
+    ""
+   ],
+   [
+    15,
+    "export default async function purchaseHourglass (user, req = {}, quantity = 1) {"
+   ],
+   [
+    16,
+    "  const key = get(req, 'params.key');"
+   ],
+   [
+    17,
+    "  if (!key) throw new BadRequest(errorMessage('missingKeyParam'));"
+   ],
+   [
+    18,
+    ""
+   ],
+   [
+    19,
+    "  const type = get(req, 'params.type');"
+   ]
+  ],
+  "diff": "@@ -13,7 +12,7 @@ import getItemInfo from '../../libs/getItemInfo';\n import { removeItemByPath } from '../pinnedGearUtils';\n import updateUserHourglasses from '../updateUserHourglasses';\n\n-export default async function purchaseHourglass (user, req = {}, analytics, quantity = 1) {\n+export default async function purchaseHourglass (user, req = {}, quantity = 1) {\n   const key = get(req, 'params.key');\n   if (!key) throw new BadRequest(errorMessage('missingKeyParam'));\n"
+ },
+ {
+  "item": "F048",
+  "kind": "pair",
+  "repository": "geonode",
+  "commit_url": "https://github.com/GeoNode/geonode/commit/e653caf78f3567996934967448a7e959db44236e",
+  "rule": "CG-SEC-002",
+  "rule_title": "Hardcoded secret",
+  "path": "geonode/utils.py",
+  "old_path": "geonode/utils.py",
+  "old_line": 1061,
+  "line": 1061,
+  "before": [
+   [
+    1057,
+    "        self.backoff_factor = 0.3"
+   ],
+   [
+    1058,
+    "        self.pool_connections = 10"
+   ],
+   [
+    1059,
+    "        self.status_forcelist = (500, 502, 503, 504)"
+   ],
+   [
+    1060,
+    "        self.username = \"admin\""
+   ],
+   [
+    1061,
+    "        self.password = \"admin\""
+   ],
+   [
+    1062,
+    "        if check_ogc_backend(geoserver.BACKEND_PACKAGE):"
+   ],
+   [
+    1063,
+    "            ogc_server_settings = settings.OGC_SERVER[\"default\"]"
+   ],
+   [
+    1064,
+    "            self.timeout = ogc_server_settings.get(\"TIMEOUT\", 5)"
+   ],
+   [
+    1065,
+    "            self.retries = ogc_server_settings.get(\"MAX_RETRIES\", 1)"
+   ]
+  ],
+  "before_line": 1061,
+  "before_mapped": true,
+  "after": [
+   [
+    1057,
+    "        self.backoff_factor = 0.3"
+   ],
+   [
+    1058,
+    "        self.pool_connections = 10"
+   ],
+   [
+    1059,
+    "        self.status_forcelist = (500, 502, 503, 504)"
+   ],
+   [
+    1060,
+    "        self.username = \"admin\""
+   ],
+   [
+    1061,
+    "        self.password = \"admin\""
+   ],
+   [
+    1062,
+    "        if check_ogc_backend(geoserver.BACKEND_PACKAGE):"
+   ],
+   [
+    1063,
+    "            ogc_server_settings = settings.OGC_SERVER[\"default\"]"
+   ],
+   [
+    1064,
+    "            self.timeout = ogc_server_settings.get(\"TIMEOUT\", 5)"
+   ],
+   [
+    1065,
+    "            self.retries = ogc_server_settings.get(\"MAX_RETRIES\", 1)"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F049",
+  "kind": "introduced",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/803e4633a27be10d80e752d62bd0dab09ed2924a",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "packages/hoppscotch-backend/src/team-collection/team-collection.service.ts",
+  "old_path": "packages/hoppscotch-backend/src/team-collection/team-collection.service.ts",
+  "old_line": null,
+  "line": 131,
+  "before": [
+   [
+    130,
+    "      });"
+   ],
+   [
+    131,
+    ""
+   ],
+   [
+    132,
+    "      for (const coll of childrenCollection) {"
+   ],
+   [
+    133,
+    "        const result = await this.exportCollectionToJSONObject(teamID, coll.id);"
+   ],
+   [
+    134,
+    "        if (E.isLeft(result)) return E.left(result.left);"
+   ],
+   [
+    135,
+    ""
+   ],
+   [
+    136,
+    "        childrenCollectionObjects.push(result.right);"
+   ],
+   [
+    137,
+    "      }"
+   ],
+   [
+    138,
+    "    }"
+   ],
+   [
+    139,
+    ""
+   ],
+   [
+    140,
+    "    const requests = await this.prisma.teamRequest.findMany({"
+   ],
+   [
+    141,
+    "      where: {"
+   ],
+   [
+    142,
+    "        teamID,"
+   ]
+  ],
+  "before_line": 136,
+  "before_mapped": false,
+  "after": [
+   [
+    127,
+    "      },"
+   ],
+   [
+    128,
+    "    });"
+   ],
+   [
+    129,
+    ""
+   ],
+   [
+    130,
+    "    for (const coll of childrenCollection) {"
+   ],
+   [
+    131,
+    "      const result = await this.exportCollectionToJSONObject(teamID, coll.id);"
+   ],
+   [
+    132,
+    "      if (E.isLeft(result)) return E.left(result.left);"
+   ],
+   [
+    133,
+    ""
+   ],
+   [
+    134,
+    "      childrenCollectionObjects.push(result.right);"
+   ],
+   [
+    135,
+    "    }"
+   ]
+  ],
+  "diff": "@@ -106,35 +106,32 @@ export class TeamCollectionService {\n    *\n    * @param teamID The Team ID\n    * @param collectionID The Collection ID\n-   * @param withChildren Whether to include child collections and their requests\n    * @returns A JSON string containing all the contents of a collection\n    */\n   async exportCollectionToJSONObject(\n     teamID: string,\n     collectionID: string,\n-    withChildren: boolean = true,\n   ): Promise<E.Right<CollectionFolder> | E.Left<string>> {\n     const collection = await this.getCollection(collectionID);\n     if (E.isLeft(collection)) return E.left(TEAM_INVALID_COLL_ID);\n\n     const childrenCollectionObjects = [];\n-    if (withChildren) {\n-      const childrenCollection = await this.prisma.teamCollection.findMany({\n-        where: {\n-          teamID,\n-          parentID: collectionID,\n-        },\n-        orderBy: {\n-          orderIndex: 'asc',\n-        },\n-      });\n\n-      for (const coll of childrenCollection) {\n-        const result = await this.exportCollectionToJSONObject(teamID, coll.id);\n-        if (E.isLeft(result)) return E.left(result.left);\n+    const childrenCollection = await this.prisma.teamCollection.findMany({\n+      where: {\n+        teamID,\n+        parentID: collectionID,\n+      },\n+      orderBy: {\n+        orderIndex: 'asc',\n+      },\n+    });\n\n... (11 more lines)"
+ },
+ {
+  "item": "F050",
+  "kind": "pair",
+  "repository": "openlibrary",
+  "commit_url": "https://github.com/internetarchive/openlibrary/commit/f5aff19fb7d0c27f3bb91f08db81a8750bae604a",
+  "rule": "CG-SEC-001",
+  "rule_title": "SQL query built with string formatting",
+  "path": "openlibrary/tests/core/test_bookshelves_events_async.py",
+  "old_path": "openlibrary/tests/core/test_bookshelves_events_async.py",
+  "old_line": 52,
+  "line": 140,
+  "before": [
+   [
+    48,
+    "            await conn.execute("
+   ],
+   [
+    49,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    50,
+    "                {\"u\": \"alice\", \"w\": 101, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2026-06-01\"},"
+   ],
+   [
+    51,
+    "            )"
+   ],
+   [
+    52,
+    "            await conn.execute("
+   ],
+   [
+    53,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    54,
+    "                {\"u\": \"alice\", \"w\": 104, \"e\": 1, \"t\": BookshelfEvent.START, \"d\": \"2026-05-01\"},"
+   ],
+   [
+    55,
+    "            )"
+   ],
+   [
+    56,
+    "            await conn.execute("
+   ]
+  ],
+  "before_line": 52,
+  "before_mapped": true,
+  "after": [
+   [
+    136,
+    "            await conn.execute("
+   ],
+   [
+    137,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    138,
+    "                {\"u\": \"alice\", \"w\": 101, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2026-06-01\"},"
+   ],
+   [
+    139,
+    "            )"
+   ],
+   [
+    140,
+    "            await conn.execute("
+   ],
+   [
+    141,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    142,
+    "                {\"u\": \"alice\", \"w\": 104, \"e\": 1, \"t\": BookshelfEvent.START, \"d\": \"2026-05-01\"},"
+   ],
+   [
+    143,
+    "            )"
+   ],
+   [
+    144,
+    "            await conn.execute("
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F051",
+  "kind": "introduced",
+  "repository": "ckan",
+  "commit_url": "https://github.com/ckan/ckan/commit/1902693db45f27bd6a4b93fb0f16b83bba5f79b8",
+  "rule": "CG-SEC-103",
+  "rule_title": "DOM XSS sink assigned a non-literal value",
+  "path": "ckan/public/base/javascript/toast.js",
+  "old_path": "ckan/public/base/javascript/toast.js",
+  "old_line": null,
+  "line": 162,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    158,
+    "    wrapper.setAttribute(\"role\", opts.style === \"danger\" ? \"alert\" : \"status\");"
+   ],
+   [
+    159,
+    "    wrapper.setAttribute(\"aria-live\", opts.style === \"danger\" ? \"assertive\" : \"polite\");"
+   ],
+   [
+    160,
+    "    wrapper.setAttribute(\"aria-atomic\", \"true\");"
+   ],
+   [
+    161,
+    ""
+   ],
+   [
+    162,
+    "    wrapper.innerHTML = `<div id=\"${containerID}\" class=\"toast-container position-fixed pb-1 ${positionClasses}\"></div>`;"
+   ],
+   [
+    163,
+    "    document.body.appendChild(wrapper);"
+   ],
+   [
+    164,
+    ""
+   ],
+   [
+    165,
+    "    return document.getElementById(containerID);"
+   ],
+   [
+    166,
+    "  };"
+   ]
+  ],
+  "diff": "@@ -0,0 +1,193 @@\n+(function (ckan, $) {\n+\n+  /**\n+   * Displays Bootstrap 5 toast notifications across CKAN\n+   *\n+   * Usage:\n+   *\n+   * ckan.toast({\n+   *    message: \"Operation completed successfully\",\n+   *    type: \"success\",\n+   *    title: \"Done\",\n+   *    icon: \"<i class='fa fa-check-circle me-2'></i>\",\n+   *    subtitle: \"Just now\",\n+   *    delay: 5000,\n+   *    position: \"bottom-right\"\n+   *    stacking: false\n+   * });\n+   *\n+   *\n+   * Options:\n+   * - message   (string)  [required] The main message body of the toast.\n+   * - type      (string)  Optional.  Defines toast style, matches keys from `styles`. Default: \"default\".\n+   * - title     (string)  Optional.  Text shown in the toast header.\n+   * - icon      (string)  Optional.  HTML for an icon displayed before the title.\n+   * - subtitle  (string)  Optional.  Text shown in the header's small subtitle area.\n+   * - delay     (number)  Optional.  Time in milliseconds before auto-hide. Default: 3000.\n+   * - position  (string)  Optional.  Position key controlling toast placement. Default: \"bottom-right\".\n+   * - showProgress  (boolean) Optional.  Whether to show a progress bar. Default: false.\n+   * - stacking  (boolean) Optional.  Whether to stack toasts on top of each other. Default: true.\n+  */\n+  var toast = function (options) {\n+    if (!options || !options.message) {\n+      console.error(\"Toast: Missing required 'message' option.\");\n+      return;\n+    }\n+\n+    const opts = {\n+      type: \"default\",\n+      title: \"\",\n... (155 more lines)"
+ },
+ {
+  "item": "F052",
+  "kind": "introduced",
+  "repository": "ckan",
+  "commit_url": "https://github.com/ckan/ckan/commit/9c010ae0a9dca9967292563ad856ca99079b891f",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "ckan/public/base/javascript/modules/autocomplete.js",
+  "old_path": "ckan/public/base/javascript/modules/autocomplete.js",
+  "old_line": null,
+  "line": 77,
+  "before": [
+   [
+    65,
+    "      if (!this.el.is('select')) {"
+   ],
+   [
+    66,
+    "        if (this.options.tags) {"
+   ],
+   [
+    67,
+    "          settings.tags = this._onQuery;"
+   ],
+   [
+    68,
+    ""
+   ],
+   [
+    69,
+    "          // Disable creating new tags"
+   ],
+   [
+    70,
+    "          if (!this.options.createtags) {"
+   ],
+   [
+    71,
+    "            settings.createSearchChoice = function(params) {"
+   ],
+   [
+    72,
+    "              return undefined;"
+   ],
+   [
+    73,
+    "            }"
+   ],
+   [
+    74,
+    "          }"
+   ],
+   [
+    75,
+    "        } else {"
+   ],
+   [
+    76,
+    "          settings.query = this._onQuery;"
+   ],
+   [
+    77,
+    "          settings.createSearchChoice = this.formatTerm;"
+   ]
+  ],
+  "before_line": 71,
+  "before_mapped": false,
+  "after": [
+   [
+    73,
+    "          settings.multiple = \"multiple\""
+   ],
+   [
+    74,
+    ""
+   ],
+   [
+    75,
+    "          // tokenizer is not applied when custom data adapter is used"
+   ],
+   [
+    76,
+    "          if (settings.tokenSeparators != null) {"
+   ],
+   [
+    77,
+    "            var Tokenizer = $.fn.select2.amd.require('select2/data/tokenizer');"
+   ],
+   [
+    78,
+    "            settings.dataAdapter = Utils.Decorate(settings.dataAdapter, Tokenizer);"
+   ],
+   [
+    79,
+    "          }"
+   ],
+   [
+    80,
+    "        }"
+   ],
+   [
+    81,
+    ""
+   ]
+  ],
+  "diff": "@@ -50,33 +49,52 @@ this.ckan.module('autocomplete', function (jQuery) {\n     setupAutoComplete: function () {\n       var settings = {\n         width: 'resolve',\n-        formatResult: this.formatResult,\n-        formatNoMatches: this.formatNoMatches,\n-        formatInputTooShort: this.formatInputTooShort,\n-        formatSearching: this.formatSearching,\n+        templateResult: this.templateResult,\n+        language: {\n+          noResults: this.formatNoMatches,\n+          inputTooShort: this.formatInputTooShort,\n+          searching: this.formatSearching,\n+        },\n         dropdownCssClass: this.options.dropdownClass,\n-        containerCssClass: this.options.containerClass,\n         tokenSeparators: this.options.tokensep.split(''),\n-        minimumInputLength: this.options.minimumInputLength\n+        minimumInputLength: this.options.minimumInputLength,\n+        selectionCssClass: this.options.containerClass\n       };\n\n       // Different keys are required depending on whether the select is\n       // tags or generic completion.\n       if (!this.el.is('select')) {\n-        if (this.options.tags) {\n-          settings.tags = this._onQuery;\n-\n-          // Disable creating new tags\n-          if (!this.options.createtags) {\n-            settings.createSearchChoice = function(params) {\n-              return undefined;\n-            }\n+\n+        settings.dataAdapter = this.dataAdapter();\n+        if ( this.options.tags ){\n+          var Utils = $.fn.select2.amd.require('select2/utils');\n+          var Tags = $.fn.select2.amd.require('select2/data/tags');\n+          settings.dataAdapter = Utils.Decorate(settings.dataAdapter, Tags)\n+          settings.multiple = \"multiple\"\n... (31 more lines)"
+ },
+ {
+  "item": "F053",
+  "kind": "pair",
+  "repository": "healthchecks",
+  "commit_url": "https://github.com/healthchecks/healthchecks/commit/b83e3791d6e2c276a13c0b40c2e435c6ec01125c",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "static/js/checks.js",
+  "old_path": "static/js/checks.js",
+  "old_line": 13,
+  "line": 13,
+  "before": [
+   [
+    9,
+    "        $(\"#update-name-form\").attr(\"action\", url);"
+   ],
+   [
+    10,
+    "        $(\"#update-name-input\").val(this.dataset.name);"
+   ],
+   [
+    11,
+    "        $(\"#update-slug-input\").val(this.dataset.slug);"
+   ],
+   [
+    12,
+    ""
+   ],
+   [
+    13,
+    "        var tagsSelectize = document.getElementById(\"update-tags-input\").selectize;"
+   ],
+   [
+    14,
+    "        tagsSelectize.setValue(this.dataset.tags.split(\" \"));"
+   ],
+   [
+    15,
+    ""
+   ],
+   [
+    16,
+    "        $(\"#update-desc-input\").val(this.dataset.desc);"
+   ],
+   [
+    17,
+    "        $(\"#update-name-modal\").modal(\"show\");"
+   ]
+  ],
+  "before_line": 13,
+  "before_mapped": true,
+  "after": [
+   [
+    9,
+    "        $(\"#update-name-form\").attr(\"action\", url);"
+   ],
+   [
+    10,
+    "        $(\"#update-name-input\").val(this.dataset.name);"
+   ],
+   [
+    11,
+    "        $(\"#update-slug-input\").val(this.dataset.slug);"
+   ],
+   [
+    12,
+    ""
+   ],
+   [
+    13,
+    "        var tagsTs = document.getElementById(\"update-tags-input\").tomselect;"
+   ],
+   [
+    14,
+    "        tagsTs.setValue(this.dataset.tags.split(\" \"));"
+   ],
+   [
+    15,
+    ""
+   ],
+   [
+    16,
+    "        $(\"#update-desc-input\").val(this.dataset.desc);"
+   ],
+   [
+    17,
+    "        $(\"#update-name-modal\").modal(\"show\");"
+   ]
+  ],
+  "diff": "@@ -10,8 +10,8 @@ $(function () {\n         $(\"#update-name-input\").val(this.dataset.name);\n         $(\"#update-slug-input\").val(this.dataset.slug);\n\n-        var tagsSelectize = document.getElementById(\"update-tags-input\").selectize;\n-        tagsSelectize.setValue(this.dataset.tags.split(\" \"));\n+        var tagsTs = document.getElementById(\"update-tags-input\").tomselect;\n+        tagsTs.setValue(this.dataset.tags.split(\" \"));\n\n         $(\"#update-desc-input\").val(this.dataset.desc);\n         $(\"#update-name-modal\").modal(\"show\");"
+ },
+ {
+  "item": "F054",
+  "kind": "introduced",
+  "repository": "edx-platform",
+  "commit_url": "https://github.com/openedx/edx-platform/commit/294f05f57e3ba73c59b31394cbc2f2c9d6808c14",
+  "rule": "CG-SEC-002",
+  "rule_title": "Hardcoded secret",
+  "path": "cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_index.py",
+  "old_path": "cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_index.py",
+  "old_line": null,
+  "line": 279,
+  "before": [
+   [
+    221,
+    "    def test_superuser_can_access_without_authz_role(self):"
+   ],
+   [
+    222,
+    "        \"\"\"Superuser should access without AuthZ role.\"\"\""
+   ],
+   [
+    223,
+    "        response = self.super_client.get(self.url)"
+   ],
+   [
+    224,
+    ""
+   ],
+   [
+    225,
+    "        assert response.status_code == status.HTTP_200_OK"
+   ],
+   [
+    226,
+    "        assert \"course_structure\" in response.data"
+   ],
+   [
+    227,
+    ""
+   ]
+  ],
+  "before_line": 227,
+  "before_mapped": false,
+  "after": [
+   [
+    275,
+    ""
+   ],
+   [
+    276,
+    "    @override_waffle_flag(core_toggles.AUTHZ_COURSE_AUTHORING_FLAG, active=False)"
+   ],
+   [
+    277,
+    "    def test_reindex_link_absent_for_course_staff_without_global_staff(self):"
+   ],
+   [
+    278,
+    "        \"\"\"A course-staff member who isn't Global Staff does not see the reindex link.\"\"\""
+   ],
+   [
+    279,
+    "        course_staff_user, password = self.create_non_staff_user()"
+   ],
+   [
+    280,
+    "        CourseStaffRole(self.course.id).add_users(course_staff_user)"
+   ],
+   [
+    281,
+    ""
+   ],
+   [
+    282,
+    "        client = AjaxEnabledTestClient()"
+   ],
+   [
+    283,
+    "        client.login(username=course_staff_user.username, password=password)"
+   ]
+  ],
+  "diff": "@@ -224,3 +226,72 @@ class CourseIndexAuthzViewTest(CourseAuthoringAuthzTestMixin, CourseTestCase):\n\n         assert response.status_code == status.HTTP_200_OK\n         assert \"course_structure\" in response.data\n+\n+\n+class CourseIndexViewReindexLinkAuthzTest(CourseAuthoringAuthzTestMixin, CourseTestCase):\n+    \"\"\"\n+    Regression tests: with AuthZ course authoring enabled, `reindex_link` (and therefore the\n+    Reindex button in the course-authoring MFE) must follow the same access rules as the actual\n+    reindex action, not be restricted to Global Staff only.\n+    \"\"\"\n+\n+    def setUp(self):\n+        super().setUp()\n+        self.url = reverse(\"cms.djangoapps.contentstore:v1:course_index\", kwargs={\"course_id\": self.course.id})\n+\n+    def test_reindex_link_present_for_non_global_staff_with_authz_permission(self):\n+        \"\"\"A non-global-staff user granted the AuthZ course-staff role sees the reindex link.\"\"\"\n+        self.add_user_to_role_in_course(self.authorized_user, COURSE_STAFF.external_key, self.course.id)\n+\n+        response = self.authorized_client.get(self.url)\n+\n+        assert response.status_code == status.HTTP_200_OK\n+        assert not self.authorized_user.is_staff\n+        assert response.data[\"reindex_link\"] == f\"/course/{self.course.id}/search_reindex\"\n+\n+    def test_reindex_link_absent_without_reindex_permission(self):\n+        \"\"\"\n+        A user with enough AuthZ permission to view the course (COURSE_EDITOR) but without the\n+        publish-content permission required to reindex does not see the reindex link.\n+        \"\"\"\n+        self.add_user_to_role_in_course(self.authorized_user, COURSE_EDITOR.external_key, self.course.id)\n+\n+        response = self.authorized_client.get(self.url)\n+\n+        assert response.status_code == status.HTTP_200_OK\n+        assert response.data[\"reindex_link\"] is None\n+\n+\n... (34 more lines)"
+ },
+ {
+  "item": "F055",
+  "kind": "pair",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/9861ee84ad593372885ebfc7cb1c487f3b9dd290",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "packages/hoppscotch-desktop/src/services/persistence.service.ts",
+  "old_path": "packages/hoppscotch-desktop/src/services/persistence.service.ts",
+  "old_line": 112,
+  "line": 294,
+  "before": [
+   [
+    108,
+    ""
+   ],
+   [
+    109,
+    "    if (currentVersion !== targetVersion) {"
+   ],
+   [
+    110,
+    "      for (const migration of migrations) {"
+   ],
+   [
+    111,
+    "        if (migration.version > parseInt(currentVersion)) {"
+   ],
+   [
+    112,
+    "          await migration.migrate()"
+   ],
+   [
+    113,
+    "        }"
+   ],
+   [
+    114,
+    "      }"
+   ],
+   [
+    115,
+    ""
+   ],
+   [
+    116,
+    "      await Store.set(STORE_NAMESPACE, STORE_KEYS.SCHEMA_VERSION, targetVersion)"
+   ]
+  ],
+  "before_line": 112,
+  "before_mapped": true,
+  "after": [
+   [
+    290,
+    "    }"
+   ],
+   [
+    291,
+    ""
+   ],
+   [
+    292,
+    "    for (const migration of migrations) {"
+   ],
+   [
+    293,
+    "      if (migration.version > parseInt(currentVersion, 10)) {"
+   ],
+   [
+    294,
+    "        const result = await migration.migrate()"
+   ],
+   [
+    295,
+    "        if (E.isLeft(result)) {"
+   ],
+   [
+    296,
+    "          return result"
+   ],
+   [
+    297,
+    "        }"
+   ],
+   [
+    298,
+    "      }"
+   ]
+  ],
+  "diff": "@@ -87,176 +216,150 @@ export class DesktopPersistenceService {\n   async init(): Promise<E.Either<StoreError, void>> {\n     const initResult = await Store.init()\n     if (E.isLeft(initResult)) {\n-      console.error(\n-        \"[PersistenceService] Failed to initialize store:\",\n-        initResult.left\n-      )\n+      Log.error(LOG_TAG, \"Failed to initialize store\", initResult.left)\n       return initResult\n     }\n-    await this.runMigrations()\n-    return initResult\n-  }\n-\n-  private async runMigrations() {\n-    const versionResult = await Store.get<string>(\n-      STORE_NAMESPACE,\n-      STORE_KEYS.SCHEMA_VERSION\n-    )\n-    const perhapsVersion = E.isRight(versionResult) ? versionResult.right : \"1\"\n-    const currentVersion = perhapsVersion ?? \"1\"\n-    const targetVersion = \"1\"\n-\n-    if (currentVersion !== targetVersion) {\n-      for (const migration of migrations) {\n-        if (migration.version > parseInt(currentVersion)) {\n-          await migration.migrate()\n-        }\n-      }\n-\n-      await Store.set(STORE_NAMESPACE, STORE_KEYS.SCHEMA_VERSION, targetVersion)\n+    const migrationResult = await this.runMigrations()\n+    if (E.isLeft(migrationResult)) {\n+      return migrationResult\n     }\n+    await this.setupRustSync()\n+    return E.right(undefined)\n   }\n\n... (259 more lines)"
+ },
+ {
+  "item": "F056",
+  "kind": "introduced",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "packages/hoppscotch-common/src/services/__tests__/ai-chat-ui.spec.ts",
+  "old_path": "packages/hoppscotch-common/src/services/__tests__/ai-chat-ui.spec.ts",
+  "old_line": null,
+  "line": 325,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    321,
+    "      ]"
+   ],
+   [
+    322,
+    ""
+   ],
+   [
+    323,
+    "      for (const prompt of prompts) {"
+   ],
+   [
+    324,
+    "        chat.pendingConfirmation.value = null"
+   ],
+   [
+    325,
+    "        await nextTick()"
+   ],
+   [
+    326,
+    "        i18n.keys.length = 0"
+   ],
+   [
+    327,
+    "        chat.pendingConfirmation.value = {"
+   ],
+   [
+    328,
+    "          name: \"A\","
+   ],
+   [
+    329,
+    "          workspace: null,"
+   ]
+  ],
+  "diff": "@@ -0,0 +1,996 @@\n+/* eslint-disable vue/one-component-per-file */\n+import { afterEach, beforeEach, describe, expect, it, vi } from \"vitest\"\n+import { TestContainer } from \"dioc/testing\"\n+import { diocPlugin } from \"dioc/vue\"\n+import * as E from \"fp-ts/Either\"\n+import { BehaviorSubject } from \"rxjs\"\n+import { createApp, defineComponent, h, nextTick, ref, type App } from \"vue\"\n+import { createMemoryHistory, createRouter } from \"vue-router\"\n+\n+vi.mock(\"~/modules/i18n\", () => ({\n+  getI18n: () => (key: string) => key,\n+  APP_LANGUAGES: [],\n+  changeAppLanguage: () => {},\n+}))\n+// Records each key; params show as \"key(a|b)\" so a test can see them.\n+const i18n = vi.hoisted(() => ({ keys: [] as string[] }))\n+vi.mock(\"~/composables/i18n\", () => ({\n+  useI18n: () => (key: string, params?: Record<string, unknown>) => {\n+    i18n.keys.push(key)\n+    return params ? `${key}(${Object.values(params).join(\"|\")})` : key\n+  },\n+}))\n+\n+const ai = vi.hoisted(() => ({\n+  enableAIExperiments: true,\n+  chat: undefined as unknown,\n+  getChatAvailability: undefined as unknown,\n+  generateRequestName: undefined as unknown,\n+}))\n+// A fresh stream per test, so services from earlier tests stop listening.\n+const auth = vi.hoisted(() => ({\n+  user$: null as null | { value: unknown; next(v: unknown): void },\n+}))\n+vi.mock(\"~/platform\", () => ({\n+  platform: {\n+    experiments: { aiExperiments: ai },\n+    auth: {\n+      getCurrentUser: () => auth.user$!.value,\n+      getCurrentUserStream: () => auth.user$,\n... (958 more lines)"
+ },
+ {
+  "item": "F057",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": 1267,
+  "line": 1601,
+  "before": [
+   [
+    1263,
+    "                      {"
+   ],
+   [
+    1264,
+    "                        type: appStoreMetadata.googlecalendar.type,"
+   ],
+   [
+    1265,
+    "                        uid: \"MOCK_ID\","
+   ],
+   [
+    1266,
+    "                        meetingId: \"MOCK_ID\","
+   ],
+   [
+    1267,
+    "                        meetingPassword: \"MOCK_PASSWORD\","
+   ],
+   [
+    1268,
+    "                        meetingUrl: \"https://UNUSED_URL\","
+   ],
+   [
+    1269,
+    "                        externalCalendarId: \"existing-event-type@example.com\","
+   ],
+   [
+    1270,
+    "                        credentialId: undefined,"
+   ],
+   [
+    1271,
+    "                      },"
+   ]
+  ],
+  "before_line": 1267,
+  "before_mapped": true,
+  "after": [
+   [
+    1597,
+    "                      {"
+   ],
+   [
+    1598,
+    "                        type: appStoreMetadata.googlecalendar.type,"
+   ],
+   [
+    1599,
+    "                        uid: \"MOCK_ID\","
+   ],
+   [
+    1600,
+    "                        meetingId: \"MOCK_ID\","
+   ],
+   [
+    1601,
+    "                        meetingPassword: \"MOCK_PASSWORD\","
+   ],
+   [
+    1602,
+    "                        meetingUrl: \"https://UNUSED_URL\","
+   ],
+   [
+    1603,
+    "                        externalCalendarId: \"existing-event-type@example.com\","
+   ],
+   [
+    1604,
+    "                        credentialId: undefined,"
+   ],
+   [
+    1605,
+    "                      },"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F058",
+  "kind": "introduced",
+  "repository": "ckan",
+  "commit_url": "https://github.com/ckan/ckan/commit/7a60264189f543fba04043d2193b09f545a6ef32",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "ckan/public/base/javascript/modules/data-viewer.js",
+  "old_path": "ckan/public/base/javascript/modules/data-viewer.js",
+  "old_line": null,
+  "line": 27,
+  "before": [
+   [
+    21,
+    "      $('.data-viewer-error', parent).removeClass('js-hide');"
+   ],
+   [
+    22,
+    "       this.el.hide();"
+   ],
+   [
+    23,
+    "    },"
+   ],
+   [
+    24,
+    ""
+   ],
+   [
+    25,
+    "    _onLoad: function() {"
+   ],
+   [
+    26,
+    "      var self = this;"
+   ],
+   [
+    27,
+    "      var loc = $('body').data('site-root');"
+   ],
+   [
+    28,
+    "      // see if page is in part of the same domain"
+   ],
+   [
+    29,
+    "      if (this.el.attr('src').substring(0, loc.length) === loc) {"
+   ],
+   [
+    30,
+    "        this._recalibrate();"
+   ],
+   [
+    31,
+    "        setTimeout(function() {"
+   ],
+   [
+    32,
+    "          self._recalibrate();"
+   ],
+   [
+    33,
+    "        }, this.options.timeout);"
+   ]
+  ],
+  "before_line": 27,
+  "before_mapped": false,
+  "after": [
+   [
+    23,
+    "    },"
+   ],
+   [
+    24,
+    ""
+   ],
+   [
+    25,
+    "    _onLoad: function() {"
+   ],
+   [
+    26,
+    "      var self = this;"
+   ],
+   [
+    27,
+    "      var loc = document.head.querySelector(['meta[name=site-root]'])?.content;"
+   ],
+   [
+    28,
+    "      // see if page is in part of the same domain"
+   ],
+   [
+    29,
+    "      if (this.el.attr('src').substring(0, loc.length) === loc) {"
+   ],
+   [
+    30,
+    "        this._recalibrate();"
+   ],
+   [
+    31,
+    "        setTimeout(function() {"
+   ]
+  ],
+  "diff": "@@ -24,7 +24,7 @@ this.ckan.module('data-viewer', function (jQuery) {\n\n     _onLoad: function() {\n       var self = this;\n-      var loc = $('body').data('site-root');\n+      var loc = document.head.querySelector(['meta[name=site-root]'])?.content;\n       // see if page is in part of the same domain\n       if (this.el.attr('src').substring(0, loc.length) === loc) {\n         this._recalibrate();\n"
+ },
+ {
+  "item": "F059",
+  "kind": "introduced",
+  "repository": "immich",
+  "commit_url": "https://github.com/immich-app/immich/commit/e66f2c7615bacbe6a9b156e300fc182e4d1a4fa3",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "server/src/services/person.service.ts",
+  "old_path": "server/src/services/person.service.ts",
+  "old_line": null,
+  "line": 162,
+  "before": [
+   [
+    156,
+    "      const assetFace = await this.personRepository.getRandomFace(personGroupId);"
+   ],
+   [
+    157,
+    ""
+   ],
+   [
+    158,
+    "      if (assetFace) {"
+   ],
+   [
+    159,
+    "        await this.personRepository.update({ ownerId, personGroupId, faceAssetId: assetFace.id });"
+   ],
+   [
+    160,
+    "        jobs.push({ name: JobName.PersonGenerateThumbnail, data: { ownerId, personGroupId } });"
+   ],
+   [
+    161,
+    "      }"
+   ],
+   [
+    162,
+    "    }"
+   ],
+   [
+    163,
+    ""
+   ],
+   [
+    164,
+    "    await this.jobRepository.queueAll(jobs);"
+   ],
+   [
+    165,
+    "  }"
+   ],
+   [
+    166,
+    ""
+   ],
+   [
+    167,
+    "  async getById(auth: AuthDto, personGroupId: string): Promise<PersonResponseDto> {"
+   ],
+   [
+    168,
+    "    await this.requireAccess({ auth, permission: Permission.PersonRead, ids: [personGroupId] });"
+   ]
+  ],
+  "before_line": 162,
+  "before_mapped": false,
+  "after": [
+   [
+    158,
+    "      if (!assetFace) {"
+   ],
+   [
+    159,
+    "        continue;"
+   ],
+   [
+    160,
+    "      }"
+   ],
+   [
+    161,
+    ""
+   ],
+   [
+    162,
+    "      await this.personRepository.update({ ownerId, personGroupId, faceAssetId: assetFace.id });"
+   ],
+   [
+    163,
+    "      jobs.push({ name: JobName.PersonGenerateThumbnail, data: { ownerId, personGroupId } });"
+   ],
+   [
+    164,
+    "    }"
+   ],
+   [
+    165,
+    ""
+   ],
+   [
+    166,
+    "    await this.jobRepository.queueAll(jobs);"
+   ]
+  ],
+  "diff": "@@ -155,10 +155,12 @@ export class PersonService extends BaseService {\n     for (const { ownerId, personGroupId } of changeFeaturePhoto) {\n       const assetFace = await this.personRepository.getRandomFace(personGroupId);\n\n-      if (assetFace) {\n-        await this.personRepository.update({ ownerId, personGroupId, faceAssetId: assetFace.id });\n-        jobs.push({ name: JobName.PersonGenerateThumbnail, data: { ownerId, personGroupId } });\n+      if (!assetFace) {\n+        continue;\n       }\n+\n+      await this.personRepository.update({ ownerId, personGroupId, faceAssetId: assetFace.id });\n+      jobs.push({ name: JobName.PersonGenerateThumbnail, data: { ownerId, personGroupId } });\n     }\n\n     await this.jobRepository.queueAll(jobs);\n"
+ },
+ {
+  "item": "F060",
+  "kind": "pair",
+  "repository": "hedgedoc",
+  "commit_url": "https://github.com/hedgedoc/hedgedoc/commit/2eeb2c72c680f2ce27b22a2d2e43fc86771a02f5",
+  "rule": "CG-SEC-103",
+  "rule_title": "DOM XSS sink assigned a non-literal value",
+  "path": "frontend/src/components/render-page/hooks/use-on-html-export-request.ts",
+  "old_path": "frontend/src/components/render-page/hooks/use-on-html-export-request.ts",
+  "old_line": 32,
+  "line": 41,
+  "before": [
+   [
+    28,
+    "          if (!documentContainer) {"
+   ],
+   [
+    29,
+    "            return"
+   ],
+   [
+    30,
+    "          }"
+   ],
+   [
+    31,
+    "          const downloadElement = document.createElement('div')"
+   ],
+   [
+    32,
+    "          downloadElement.innerHTML = documentContainer.innerHTML"
+   ],
+   [
+    33,
+    "          ;["
+   ],
+   [
+    34,
+    "            ...downloadElement.querySelectorAll(`.${clickShieldCss['click-shield']}`),"
+   ],
+   [
+    35,
+    "            ...downloadElement.querySelectorAll(`.${copyButtonCss['copy-button']}`),"
+   ],
+   [
+    36,
+    "            ...downloadElement.querySelectorAll(`.${highlightedCodeCss['linenumber']}`)"
+   ]
+  ],
+  "before_line": 32,
+  "before_mapped": true,
+  "after": [
+   [
+    37,
+    "          if (!documentContainer) {"
+   ],
+   [
+    38,
+    "            return"
+   ],
+   [
+    39,
+    "          }"
+   ],
+   [
+    40,
+    "          const exportMarkdownBodyElement = document.createElement('div')"
+   ],
+   [
+    41,
+    "          exportMarkdownBodyElement.innerHTML = documentContainer.innerHTML"
+   ],
+   [
+    42,
+    "          cleanupHtmlForExport(exportMarkdownBodyElement, noteUrl)"
+   ],
+   [
+    43,
+    ""
+   ],
+   [
+    44,
+    "          if (withStyles) {"
+   ],
+   [
+    45,
+    "            await extractImagesToBase64(exportMarkdownBodyElement)"
+   ]
+  ],
+  "diff": "@@ -23,27 +30,25 @@ export const useOnHtmlExportRequest = (communicator: RendererToEditorCommunicato\n     CommunicationMessageType.EXPORT_HTML_REQUEST,\n     useMemo(\n       () =>\n-        ({ noteUrl }) => {\n-          const documentContainer = document.querySelector('.markdown-body')\n+        async ({ noteUrl, withStyles, noteTitle }) => {\n+          let finalHtml: string\n+          const rootElementQuery = withStyles ? `.${markdownDocumentCss.document}` : '.markdown-body'\n+          const documentContainer = document.querySelector(rootElementQuery)\n           if (!documentContainer) {\n             return\n           }\n-          const downloadElement = document.createElement('div')\n-          downloadElement.innerHTML = documentContainer.innerHTML\n-          ;[\n-            ...downloadElement.querySelectorAll(`.${clickShieldCss['click-shield']}`),\n-            ...downloadElement.querySelectorAll(`.${copyButtonCss['copy-button']}`),\n-            ...downloadElement.querySelectorAll(`.${highlightedCodeCss['linenumber']}`)\n-          ].forEach((element) => element.remove())\n-          console.debug('Note URL to replace: ', noteUrl)\n-          downloadElement.querySelectorAll('a[href]').forEach((element) => {\n-            const href = element.getAttribute('href')\n-            if (!href || !href.startsWith(noteUrl)) {\n-              return\n-            }\n-            element.setAttribute('href', href.replace(noteUrl, ''))\n-          })\n-          const finalHtml = downloadElement.innerHTML\n+          const exportMarkdownBodyElement = document.createElement('div')\n+          exportMarkdownBodyElement.innerHTML = documentContainer.innerHTML\n+          cleanupHtmlForExport(exportMarkdownBodyElement, noteUrl)\n+\n+          if (withStyles) {\n+            await extractImagesToBase64(exportMarkdownBodyElement)\n+            const finalHtmlElement = await buildFullHtmlPageForExport(exportMarkdownBodyElement, noteTitle)\n+            finalHtml = finalHtmlElement.outerHTML\n+          } else {\n+            finalHtml = exportMarkdownBodyElement.innerHTML\n+          }\n... (4 more lines)"
+ },
+ {
+  "item": "F061",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": 1395,
+  "line": 1728,
+  "before": [
+   [
+    1391,
+    "              bookingRef: {"
+   ],
+   [
+    1392,
+    "                type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    1393,
+    "                uid: \"MOCK_ID\","
+   ],
+   [
+    1394,
+    "                meetingId: \"MOCK_ID\","
+   ],
+   [
+    1395,
+    "                meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    1396,
+    "                meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    1397,
+    "              },"
+   ],
+   [
+    1398,
+    "            });"
+   ],
+   [
+    1399,
+    ""
+   ]
+  ],
+  "before_line": 1395,
+  "before_mapped": true,
+  "after": [
+   [
+    1724,
+    "              bookingRef: {"
+   ],
+   [
+    1725,
+    "                type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    1726,
+    "                uid: \"MOCK_ID\","
+   ],
+   [
+    1727,
+    "                meetingId: \"MOCK_ID\","
+   ],
+   [
+    1728,
+    "                meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    1729,
+    "                meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    1730,
+    "              },"
+   ],
+   [
+    1731,
+    "            });"
+   ],
+   [
+    1732,
+    ""
+   ]
+  ],
+  "diff": "@@ -1382,8 +1716,7 @@ describe(\"handleNewBooking\", () => {\n               },\n             });\n\n-            expectWorkflowToBeTriggered({ emailsToReceive: [organizer.email], emails });\n-\n+\n             expectSuccessfulVideoMeetingUpdationInCalendar(videoMock, {\n               calEvent: {\n                 location: \"http://mock-dailyvideo.example.com\","
+ },
+ {
+  "item": "F062",
+  "kind": "pair",
+  "repository": "nodebb",
+  "commit_url": "https://github.com/NodeBB/NodeBB/commit/331599fe89bed8c8ae80199efafeee9e81f72dbf",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "test/topics/crossposts.js",
+  "old_path": "test/topics/crossposts.js",
+  "old_line": 660,
+  "line": 678,
+  "before": [
+   [
+    656,
+    "\t\t\t});"
+   ],
+   [
+    657,
+    ""
+   ],
+   [
+    658,
+    "\t\t\tit('should send an Announce to the topic author when crossposted to a local category', async () => {"
+   ],
+   [
+    659,
+    "\t\t\t\tconst username = utils.generateUUID().slice(0, 8);"
+   ],
+   [
+    660,
+    "\t\t\t\tconst crossposter = await user.create({ username, password: '123456' });"
+   ],
+   [
+    661,
+    "\t\t\t\tconst login = await helpers.loginUser(username, '123456');"
+   ],
+   [
+    662,
+    "\t\t\t\tactivitypub._sent.clear();"
+   ],
+   [
+    663,
+    ""
+   ],
+   [
+    664,
+    "\t\t\t\tconst crosspostCid = (await categories.create({ name: utils.generateUUID().slice(0, 8) })).cid;"
+   ]
+  ],
+  "before_line": 660,
+  "before_mapped": true,
+  "after": [
+   [
+    674,
+    "\t\t\t});"
+   ],
+   [
+    675,
+    ""
+   ],
+   [
+    676,
+    "\t\t\tit('should send an Announce to the topic author when crossposted to a local category', async () => {"
+   ],
+   [
+    677,
+    "\t\t\t\tconst username = utils.generateUUID().slice(0, 8);"
+   ],
+   [
+    678,
+    "\t\t\t\tconst crossposter = await user.create({ username, password: '123456' });"
+   ],
+   [
+    679,
+    "\t\t\t\tconst login = await helpers.loginUser(username, '123456');"
+   ],
+   [
+    680,
+    "\t\t\t\tactivitypub._sent.clear();"
+   ],
+   [
+    681,
+    ""
+   ],
+   [
+    682,
+    "\t\t\t\tconst crosspostCid = (await categories.create({ name: utils.generateUUID().slice(0, 8) })).cid;"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F063",
+  "kind": "pair",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/403c4626495b979fe831a8f0baf6d8577708e3d7",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "arches/app/media/js/views/resource/edit-log.js",
+  "old_path": "arches/app/media/js/views/resource/edit-log.js",
+  "old_line": 58,
+  "line": 61,
+  "before": [
+   [
+    54,
+    "                }"
+   ],
+   [
+    55,
+    "                full_value[k] = {new_value: v};"
+   ],
+   [
+    56,
+    "                if (edit.card) {"
+   ],
+   [
+    57,
+    "                    _.each(edit.card.nodes, function(node){"
+   ],
+   [
+    58,
+    "                        if (k == node.nodeid) {"
+   ],
+   [
+    59,
+    "                            full_value[node.nodeid].node = node;"
+   ],
+   [
+    60,
+    "                        }"
+   ],
+   [
+    61,
+    "                    }, this);"
+   ],
+   [
+    62,
+    "                }"
+   ]
+  ],
+  "before_line": 58,
+  "before_mapped": true,
+  "after": [
+   [
+    57,
+    "                }"
+   ],
+   [
+    58,
+    "                full_value[nodeid] = {new_value: val, is_array: is_array};"
+   ],
+   [
+    59,
+    "                if (edit.card) {"
+   ],
+   [
+    60,
+    "                    _.each(edit.card.nodes, function(node){"
+   ],
+   [
+    61,
+    "                        if (nodeid == node.nodeid) {"
+   ],
+   [
+    62,
+    "                            full_value[node.nodeid].node = node;"
+   ],
+   [
+    63,
+    "                        }"
+   ],
+   [
+    64,
+    "                    }, this);"
+   ],
+   [
+    65,
+    "                }"
+   ]
+  ],
+  "diff": "@@ -48,20 +50,21 @@ var ResourceEditLogView = BaseManagerView.extend({\n                 return value;\n             }\n\n-            _.each(value, function(v, k){\n-                if (_.isObject(v) && v['features']) {\n-                    v = _.map(v['features'], function(feature){return JSON.stringify(feature['geometry'], rounder, 4);});\n+            _.each(value, function(val, nodeid){\n+                var is_array = _.isArray(val);\n+                if (_.isObject(val) && val['features']) {\n+                    val = _.map(val['features'], function(feature){return JSON.stringify(feature['geometry'], rounder, 4);});\n                 }\n-                full_value[k] = {new_value: v};\n+                full_value[nodeid] = {new_value: val, is_array: is_array};\n                 if (edit.card) {\n                     _.each(edit.card.nodes, function(node){\n-                        if (k == node.nodeid) {\n+                        if (nodeid == node.nodeid) {\n                             full_value[node.nodeid].node = node;\n                         }\n                     }, this);\n                 }\n             });\n-            return _.map(full_value, function(v,k){return v;});   // eslint-disable-line @typescript-eslint/no-unused-vars\n+            return _.map(full_value, function(val,nodeid){return val;});   // eslint-disable-line @typescript-eslint/no-unused-vars\n         };\n\n         _.each(edits, function(edit){"
+ },
+ {
+  "item": "F064",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": 1260,
+  "line": 1594,
+  "before": [
+   [
+    1256,
+    "                      {"
+   ],
+   [
+    1257,
+    "                        type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    1258,
+    "                        uid: \"MOCK_ID\","
+   ],
+   [
+    1259,
+    "                        meetingId: \"MOCK_ID\","
+   ],
+   [
+    1260,
+    "                        meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    1261,
+    "                        meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    1262,
+    "                      },"
+   ],
+   [
+    1263,
+    "                      {"
+   ],
+   [
+    1264,
+    "                        type: appStoreMetadata.googlecalendar.type,"
+   ]
+  ],
+  "before_line": 1260,
+  "before_mapped": true,
+  "after": [
+   [
+    1590,
+    "                      {"
+   ],
+   [
+    1591,
+    "                        type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    1592,
+    "                        uid: \"MOCK_ID\","
+   ],
+   [
+    1593,
+    "                        meetingId: \"MOCK_ID\","
+   ],
+   [
+    1594,
+    "                        meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    1595,
+    "                        meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    1596,
+    "                      },"
+   ],
+   [
+    1597,
+    "                      {"
+   ],
+   [
+    1598,
+    "                        type: appStoreMetadata.googlecalendar.type,"
+   ]
+  ],
+  "diff": "@@ -1201,53 +1345,243 @@ describe(\"handleNewBooking\", () => {\n               credentials: [getGoogleCalendarCredential()],\n               selectedCalendars: [TestData.selectedCalendars.google],\n             });\n-\n             const { dateString: plus1DateString } = getDate({ dateIncrement: 1 });\n             const uidOfBookingToBeRescheduled = \"n5Wv3eHgconAED2j4gcVhP\";\n-            const previousOrganizerIdForTheBooking = 1001;\n-            await createBookingScenario(\n-              getScenarioData({\n-                webhooks: [\n-                  {\n-                    userId: organizer.id,\n-                    eventTriggers: [\"BOOKING_CREATED\"],\n-                    subscriberUrl: \"http://my-webhook.example.com\",\n-                    active: true,\n-                    eventTypeId: 1,\n-                    appId: null,\n-                  },\n-                ],\n-                workflows: [\n-                  {\n-                    userId: organizer.id,\n-                    trigger: \"RESCHEDULE_EVENT\",\n-                    action: \"EMAIL_HOST\",\n-                    template: \"REMINDER\",\n-                    activeOn: [1],\n-                  },\n-                ],\n-                eventTypes: [\n-                  {\n-                    id: 1,\n-                    requiresConfirmation: true,\n-                    slotInterval: 15,\n-                    length: 15,\n-                    users: [\n-                      {\n-                        id: 101,\n-                      },\n-                    ],\n... (248 more lines)"
+ },
+ {
+  "item": "F065",
+  "kind": "introduced",
+  "repository": "lnbits",
+  "commit_url": "https://github.com/lnbits/lnbits/commit/7eb996520584b3da9ed865c944e11ddbd2095998",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "tests/api/test_admin_api.py",
+  "old_path": "tests/api/test_admin_api.py",
+  "old_line": null,
+  "line": 151,
+  "before": [
+   [
+    144,
+    "    assert restart.json()[\"status\"] == \"Success\""
+   ],
+   [
+    145,
+    "    assert server_restart.is_set() is True"
+   ],
+   [
+    146,
+    "    server_restart.clear()"
+   ],
+   [
+    147,
+    ""
+   ],
+   [
+    148,
+    ""
+   ],
+   [
+    149,
+    "@pytest.mark.anyio"
+   ],
+   [
+    150,
+    "async def test_admin_delete_settings_requires_superuser("
+   ],
+   [
+    151,
+    "    client: AsyncClient, superuser_token: str"
+   ],
+   [
+    152,
+    "):"
+   ],
+   [
+    153,
+    "    server_restart.clear()"
+   ],
+   [
+    154,
+    "    response = await client.delete("
+   ],
+   [
+    155,
+    "        \"/admin/api/v1/settings\","
+   ],
+   [
+    156,
+    "        headers={\"Authorization\": f\"Bearer {superuser_token}\"},"
+   ]
+  ],
+  "before_line": 150,
+  "before_mapped": true,
+  "after": [
+   [
+    147,
+    "    server_restart.clear()"
+   ],
+   [
+    148,
+    ""
+   ],
+   [
+    149,
+    ""
+   ],
+   [
+    150,
+    "@pytest.mark.anyio"
+   ],
+   [
+    151,
+    "async def test_admin_delete_settings_requires_superuser("
+   ],
+   [
+    152,
+    "    client: AsyncClient, superuser_token: str"
+   ],
+   [
+    153,
+    "):"
+   ],
+   [
+    154,
+    "    await set_settings_field(\"lnbits_site_title\", \"Reset me\")"
+   ],
+   [
+    155,
+    "    await set_settings_field(\"lnbits_backend_wallet_class\", \"BoltzWallet\")"
+   ]
+  ],
+  "diff": "@@ -150,6 +151,15 @@ async def test_admin_partial_reset_restart_and_backup(\n async def test_admin_delete_settings_requires_superuser(\n     client: AsyncClient, superuser_token: str\n ):\n+    await set_settings_field(\"lnbits_site_title\", \"Reset me\")\n+    await set_settings_field(\"lnbits_backend_wallet_class\", \"BoltzWallet\")\n+    await set_settings_field(\"boltz_mnemonic\", \"keep boltz seed\")\n+    await set_settings_field(\"boltz_mnemonic_backup_confirmed\", True)\n+    await set_settings_field(\"phoenixd_mnemonic\", \"keep phoenixd seed\")\n+    await set_settings_field(\"phoenixd_mnemonic_backup_confirmed\", True)\n+    await set_settings_field(\"spark_l2_mnemonic\", \"keep spark seed\")\n+    await set_settings_field(\"spark_l2_mnemonic_backup_confirmed\", True)\n+\n     server_restart.clear()\n     response = await client.delete(\n         \"/admin/api/v1/settings\","
+ },
+ {
+  "item": "F066",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": 1370,
+  "line": 1704,
+  "before": [
+   [
+    1366,
+    "                  {"
+   ],
+   [
+    1367,
+    "                    type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    1368,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    1369,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    1370,
+    "                    meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    1371,
+    "                    meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    1372,
+    "                  },"
+   ],
+   [
+    1373,
+    "                  {"
+   ],
+   [
+    1374,
+    "                    type: appStoreMetadata.googlecalendar.type,"
+   ]
+  ],
+  "before_line": 1370,
+  "before_mapped": true,
+  "after": [
+   [
+    1700,
+    "                  {"
+   ],
+   [
+    1701,
+    "                    type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    1702,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    1703,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    1704,
+    "                    meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    1705,
+    "                    meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    1706,
+    "                  },"
+   ],
+   [
+    1707,
+    "                  {"
+   ],
+   [
+    1708,
+    "                    type: appStoreMetadata.googlecalendar.type,"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F067",
+  "kind": "introduced",
+  "repository": "ghost",
+  "commit_url": "https://github.com/TryGhost/Ghost/commit/0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "tools/scripts/test/public-apps.test.ts",
+  "old_path": "tools/scripts/test/public-apps.test.ts",
+  "old_line": null,
+  "line": 67,
+  "before": [
+   [
+    61,
+    "  // If the repo ever violates it, one of those two is broken \u2014 or someone"
+   ],
+   [
+    62,
+    "  // hand-edited a version without running \"pnpm ship\"."
+   ],
+   [
+    63,
+    "  it('holds for every public app in the repo right now', async () => {"
+   ],
+   [
+    64,
+    "    const defaults = await readDefaults();"
+   ],
+   [
+    65,
+    ""
+   ],
+   [
+    66,
+    "    for (const app of PUBLIC_APPS) {"
+   ],
+   [
+    67,
+    "      const { version } = await readJson(join(ROOT_DIR, app.path, 'package.json'));"
+   ],
+   [
+    68,
+    ""
+   ],
+   [
+    69,
+    "      assert.strictEqual("
+   ],
+   [
+    70,
+    "        defaults[app.configKey].version,"
+   ],
+   [
+    71,
+    "        majorMinor(version),"
+   ],
+   [
+    72,
+    "        `${app.packageName}: package.json is ${version}, defaults.json says ${defaults[app.configKey].version}`,"
+   ],
+   [
+    73,
+    "      );"
+   ]
+  ],
+  "before_line": 67,
+  "before_mapped": false,
+  "after": [
+   [
+    63,
+    "  it('holds for every public app in the repo right now', async () => {"
+   ],
+   [
+    64,
+    "    const defaults = (await readDefaults()) as Record<string, { version: string }>;"
+   ],
+   [
+    65,
+    ""
+   ],
+   [
+    66,
+    "    for (const app of PUBLIC_APPS) {"
+   ],
+   [
+    67,
+    "      const { version } = await readJson<{ version: string }>("
+   ],
+   [
+    68,
+    "        join(ROOT_DIR, app.path, 'package.json'),"
+   ],
+   [
+    69,
+    "      );"
+   ],
+   [
+    70,
+    ""
+   ],
+   [
+    71,
+    "      assert.strictEqual("
+   ]
+  ],
+  "diff": "@@ -61,15 +61,17 @@ describe('the major.minor invariant', () => {\n   // If the repo ever violates it, one of those two is broken \u2014 or someone\n   // hand-edited a version without running \"pnpm ship\".\n   it('holds for every public app in the repo right now', async () => {\n-    const defaults = await readDefaults();\n+    const defaults = (await readDefaults()) as Record<string, { version: string }>;\n\n     for (const app of PUBLIC_APPS) {\n-      const { version } = await readJson(join(ROOT_DIR, app.path, 'package.json'));\n+      const { version } = await readJson<{ version: string }>(\n+        join(ROOT_DIR, app.path, 'package.json'),\n+      );\n\n       assert.strictEqual(\n-        defaults[app.configKey].version,\n+        defaults[app.configKey]?.version,\n         majorMinor(version),\n-        `${app.packageName}: package.json is ${version}, defaults.json says ${defaults[app.configKey].version}`,\n+        `${app.packageName}: package.json is ${version}, defaults.json says ${defaults[app.configKey]?.version}`,\n       );\n     }\n   });\n"
+ },
+ {
+  "item": "F068",
+  "kind": "pair",
+  "repository": "nodebb",
+  "commit_url": "https://github.com/NodeBB/NodeBB/commit/9d122948cf783fc72c8c01c7aab0f42b2561b3c3",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "test/user.js",
+  "old_path": "test/user.js",
+  "old_line": 1999,
+  "line": 2030,
+  "before": [
+   [
+    1995,
+    ""
+   ],
+   [
+    1996,
+    "\t\tit('should fail to add user to queue if username is taken', async () => {"
+   ],
+   [
+    1997,
+    "\t\t\tconst { body } = await helpers.registerUser({"
+   ],
+   [
+    1998,
+    "\t\t\t\tusername: 'rejectme',"
+   ],
+   [
+    1999,
+    "\t\t\t\tpassword: '123456',"
+   ],
+   [
+    2000,
+    "\t\t\t\t'password-confirm': '123456',"
+   ],
+   [
+    2001,
+    "\t\t\t\temail: '<script>alert(\"ok\")<script>reject@me.com',"
+   ],
+   [
+    2002,
+    "\t\t\t\tgdpr_consent: true,"
+   ],
+   [
+    2003,
+    "\t\t\t});"
+   ]
+  ],
+  "before_line": 1999,
+  "before_mapped": true,
+  "after": [
+   [
+    2026,
+    ""
+   ],
+   [
+    2027,
+    "\t\tit('should fail to add user to queue if username is taken', async () => {"
+   ],
+   [
+    2028,
+    "\t\t\tconst { body } = await helpers.registerUser({"
+   ],
+   [
+    2029,
+    "\t\t\t\tusername: 'rejectme',"
+   ],
+   [
+    2030,
+    "\t\t\t\tpassword: '123456',"
+   ],
+   [
+    2031,
+    "\t\t\t\t'password-confirm': '123456',"
+   ],
+   [
+    2032,
+    "\t\t\t\temail: '<script>alert(\"ok\")<script>reject@me.com',"
+   ],
+   [
+    2033,
+    "\t\t\t\tgdpr_consent: true,"
+   ],
+   [
+    2034,
+    "\t\t\t});"
+   ]
+  ],
+  "diff": "@@ -1993,6 +1993,37 @@ describe('User', () => {\n \t\t\tassert(body.includes('&lt;script&gt;alert(&quot;ok&quot;)&lt;script&gt;reject@me.com'));\n \t\t});\n\n+\t\tit('should split the queue into regular requests and suspected spam', async () => {\n+\t\t\tawait helpers.registerUser({\n+\t\t\t\tusername: 'spamqueued',\n+\t\t\t\tpassword: '123456',\n+\t\t\t\temail: 'spamqueued@me.com',\n+\t\t\t\tgdpr_consent: true,\n+\t\t\t});\n+\t\t\tconst filterMethod = async (data) => {\n+\t\t\t\tdata.users.forEach((user) => {\n+\t\t\t\t\tif (user.username === 'spamqueued') {\n+\t\t\t\t\t\tuser.spamChecked = true;\n+\t\t\t\t\t\tuser.ipSpam = true;\n+\t\t\t\t\t}\n+\t\t\t\t});\n+\t\t\t\treturn data;\n+\t\t\t};\n+\t\t\tplugins.hooks.register('test-plugin', { hook: 'filter:user.getRegistrationQueue', method: filterMethod });\n+\t\t\ttry {\n+\t\t\t\tconst { jar } = await helpers.loginUser('admin', '123456');\n+\t\t\t\tconst { body } = await request.get(`${nconf.get('url')}/api/registration-queue`, { jar });\n+\t\t\t\tassert.deepStrictEqual(body.spamUsers.map(u => u.username), ['spamqueued']);\n+\t\t\t\tassert(body.spamUsers.every(u => u.spamSuspected === true));\n+\t\t\t\tassert(!body.cleanUsers.some(u => u.username === 'spamqueued'));\n+\t\t\t\tassert(body.cleanUsers.every(u => u.spamSuspected === false));\n+\t\t\t\tassert.strictEqual(body.users.length, body.cleanUsers.length + body.spamUsers.length);\n+\t\t\t} finally {\n+\t\t\t\tplugins.hooks.unregister('test-plugin', 'filter:user.getRegistrationQueue', filterMethod);\n+\t\t\t\tawait User.rejectRegistration('spamqueued');\n+\t\t\t}\n+\t\t});\n+\n \t\tit('should fail to add user to queue if username is taken', async () => {\n \t\t\tconst { body } = await helpers.registerUser({\n \t\t\t\tusername: 'rejectme',\n"
+ },
+ {
+  "item": "F069",
+  "kind": "introduced",
+  "repository": "kitsune",
+  "commit_url": "https://github.com/mozilla/kitsune/commit/59b6937db573505c764bec9c87bd786981848487",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_line": null,
+  "line": 844,
+  "before": [
+   [
+    837,
+    "        \"</div>\" +"
+   ],
+   [
+    838,
+    "        \"</section>\""
+   ],
+   [
+    839,
+    "    );"
+   ],
+   [
+    840,
+    "    var kbox;"
+   ],
+   [
+    841,
+    ""
+   ],
+   [
+    842,
+    "    var cannedResponsesUrl = \"/kb/common-forum-responses\";"
+   ],
+   [
+    843,
+    "    var previewUrl = \"answer-preview-async\";"
+   ],
+   [
+    844,
+    ""
+   ],
+   [
+    845,
+    "    function updatePreview() {"
+   ],
+   [
+    846,
+    "      var response = html.querySelector(\"#response-content\").value;"
+   ],
+   [
+    847,
+    "      var tokenEl = document.querySelector(\"[name=csrfmiddlewaretoken]\");"
+   ],
+   [
+    848,
+    "      var token = tokenEl ? tokenEl.getAttribute(\"value\") : \"\";"
+   ],
+   [
+    849,
+    ""
+   ]
+  ],
+  "before_line": 843,
+  "before_mapped": false,
+  "after": [
+   [
+    840,
+    "    var kbox;"
+   ],
+   [
+    841,
+    ""
+   ],
+   [
+    842,
+    "    var cannedResponsesUrl = \"/kb/common-forum-responses\";"
+   ],
+   [
+    843,
+    "    var previewBtn = document.getElementById(\"preview\");"
+   ],
+   [
+    844,
+    "    var siteLanguage = window.location.pathname.split(\"/\")[1];"
+   ],
+   [
+    845,
+    "    var previewUrl = previewBtn"
+   ],
+   [
+    846,
+    "      ? previewBtn.dataset.previewUrl"
+   ],
+   [
+    847,
+    "      : \"/\" + siteLanguage + \"/questions/answer-preview-async\";"
+   ],
+   [
+    848,
+    ""
+   ]
+  ],
+  "diff": "@@ -840,7 +840,11 @@ Marky.CannedResponsesButton.prototype = Object.assign({}, Marky.SimpleButton.pro\n     var kbox;\n\n     var cannedResponsesUrl = \"/kb/common-forum-responses\";\n-    var previewUrl = \"answer-preview-async\";\n+    var previewBtn = document.getElementById(\"preview\");\n+    var siteLanguage = window.location.pathname.split(\"/\")[1];\n+    var previewUrl = previewBtn\n+      ? previewBtn.dataset.previewUrl\n+      : \"/\" + siteLanguage + \"/questions/answer-preview-async\";\n\n     function updatePreview() {\n       var response = html.querySelector(\"#response-content\").value;\n"
+ },
+ {
+  "item": "F070",
+  "kind": "introduced",
+  "repository": "readthedocs",
+  "commit_url": "https://github.com/readthedocs/readthedocs.org/commit/857138d4d9659a62ce46f52a358f535b6ffeef75",
+  "rule": "CG-SEC-002",
+  "rule_title": "Hardcoded secret",
+  "path": "readthedocs/rtd_tests/tests/test_api.py",
+  "old_path": "readthedocs/rtd_tests/tests/test_api.py",
+  "old_line": null,
+  "line": 331,
+  "before": [
+   [
+    311,
+    "            {\"one\": \"two\"},"
+   ],
+   [
+    312,
+    "        )"
+   ],
+   [
+    313,
+    "        self.assertEqual("
+   ],
+   [
+    314,
+    "            Build.objects.get(pk=build_one.pk).readthedocs_yaml_config.pk,"
+   ],
+   [
+    315,
+    "            Build.objects.get(pk=build_two.pk).readthedocs_yaml_config.pk,"
+   ],
+   [
+    316,
+    "        )"
+   ],
+   [
+    317,
+    ""
+   ],
+   [
+    318,
+    "    def test_response_building(self):"
+   ],
+   [
+    319,
+    "        \"\"\"The ``view docs`` attr should return a link to the dashboard.\"\"\""
+   ],
+   [
+    320,
+    "        client = APIClient()"
+   ],
+   [
+    321,
+    "        client.login(username=\"super\", password=\"test\")"
+   ],
+   [
+    322,
+    "        project = get("
+   ],
+   [
+    323,
+    "            Project,"
+   ]
+  ],
+  "before_line": 317,
+  "before_mapped": false,
+  "after": [
+   [
+    327,
+    "        )"
+   ],
+   [
+    328,
+    "        assert not project.has_feature(Feature.USE_BUILD_ISOLATED)"
+   ],
+   [
+    329,
+    ""
+   ],
+   [
+    330,
+    "        client = APIClient()"
+   ],
+   [
+    331,
+    "        _, build_api_key = BuildAPIKey.objects.create_key(project)"
+   ],
+   [
+    332,
+    "        client.credentials(HTTP_AUTHORIZATION=f\"Token {build_api_key}\")"
+   ],
+   [
+    333,
+    ""
+   ],
+   [
+    334,
+    "        resp = client.patch("
+   ],
+   [
+    335,
+    "            \"/api/v2/build/{}/\".format(build.pk),"
+   ]
+  ],
+  "diff": "@@ -315,6 +315,30 @@ class APIBuildTests(TestCase):\n             Build.objects.get(pk=build_two.pk).readthedocs_yaml_config.pk,\n         )\n\n+    @mock.patch(\"readthedocs.api.v2.views.model_views.run_post_build_tasks\")\n+    def test_finishing_uploaded_build_runs_post_build_tasks(self, run_post_build_tasks):\n+        project = Project.objects.get(pk=1)\n+        version = project.versions.first()\n+        build = Build.objects.create(\n+            project=project,\n+            version=version,\n+            state=BUILD_STATE_TRIGGERED,\n+            is_uploaded=True,\n+        )\n+        assert not project.has_feature(Feature.USE_BUILD_ISOLATED)\n+\n+        client = APIClient()\n+        _, build_api_key = BuildAPIKey.objects.create_key(project)\n+        client.credentials(HTTP_AUTHORIZATION=f\"Token {build_api_key}\")\n+\n+        resp = client.patch(\n+            \"/api/v2/build/{}/\".format(build.pk),\n+            {\"state\": BUILD_STATE_FINISHED},\n+            format=\"json\",\n+        )\n+        assert resp.status_code == status.HTTP_200_OK\n+        run_post_build_tasks.delay.assert_called_once_with(build_pk=build.pk)\n+\n     def test_response_building(self):\n         \"\"\"The ``view docs`` attr should return a link to the dashboard.\"\"\"\n         client = APIClient()\n"
+ },
+ {
+  "item": "F071",
+  "kind": "pair",
+  "repository": "kitsune",
+  "commit_url": "https://github.com/mozilla/kitsune/commit/7558489f48358f1f90ab0dfd5e4cc1a285240693",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_line": 421,
+  "line": 568,
+  "before": [
+   [
+    417,
+    "        '</ol><div class=\"submit sumo-button-wrap align-full reverse-on-desktop\"><button type=\"button\" class=\"sumo-button primary-button\"></button>' +"
+   ],
+   [
+    418,
+    "        '<a href=\"#cancel\" class=\"kbox-cancel sumo-button secondary-button\">' + gettext(\"Cancel\") +"
+   ],
+   [
+    419,
+    "        \"</a></div></section>\""
+   ],
+   [
+    420,
+    "    );"
+   ],
+   [
+    421,
+    "    var selectedText = me.getSelectedText();"
+   ],
+   [
+    422,
+    "    var kbox;"
+   ],
+   [
+    423,
+    ""
+   ],
+   [
+    424,
+    "    html.querySelectorAll('li input[type=\"text\"]').forEach(function (input) {"
+   ],
+   [
+    425,
+    "      input.addEventListener(\"focus\", function () {"
+   ]
+  ],
+  "before_line": 421,
+  "before_mapped": true,
+  "after": [
+   [
+    564,
+    "        '</ol><div class=\"submit sumo-button-wrap align-full reverse-on-desktop\"><button type=\"button\" class=\"sumo-button primary-button\"></button>' +"
+   ],
+   [
+    565,
+    "        '<a href=\"#cancel\" class=\"kbox-cancel sumo-button secondary-button\">' + gettext(\"Cancel\") +"
+   ],
+   [
+    566,
+    "        \"</a></div></section>\""
+   ],
+   [
+    567,
+    "    );"
+   ],
+   [
+    568,
+    "    var selectedText = me.getSelectedText();"
+   ],
+   [
+    569,
+    "    var kbox;"
+   ],
+   [
+    570,
+    ""
+   ],
+   [
+    571,
+    "    html.querySelectorAll('li input[type=\"text\"]').forEach(function (input) {"
+   ],
+   [
+    572,
+    "      input.addEventListener(\"focus\", function () {"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F072",
+  "kind": "introduced",
+  "repository": "openlibrary",
+  "commit_url": "https://github.com/internetarchive/openlibrary/commit/53015559ebcd126850e7b07792ebc7bcfa847919",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "openlibrary/plugins/openlibrary/js/graphs/plot.js",
+  "old_path": "openlibrary/plugins/openlibrary/js/graphs/plot.js",
+  "old_line": null,
+  "line": 20,
+  "before": [
+   [
+    15,
+    " * A special graph loaded on the following URLs:"
+   ],
+   [
+    16,
+    " * - http://localhost:8080/subjects/fantasy#sort=date_published&ebooks=true"
+   ],
+   [
+    17,
+    " * - http://localhost:8080/publishers/Barnes_&_Noble"
+   ],
+   [
+    18,
+    " */"
+   ],
+   [
+    19,
+    "export function loadEditionsGraph() {"
+   ],
+   [
+    20,
+    "    var data, options, placeholder,"
+   ],
+   [
+    21,
+    "        plot, dateFrom, dateTo, previousPoint;"
+   ],
+   [
+    22,
+    "    data = [{data: JSON.parse(document.getElementById('graph-json-chartPubHistory').textContent)}];"
+   ],
+   [
+    23,
+    "    options = {"
+   ],
+   [
+    24,
+    "        series: {"
+   ],
+   [
+    25,
+    "            bars: {"
+   ],
+   [
+    26,
+    "                show: true,"
+   ],
+   [
+    27,
+    "                fill: 0.6,"
+   ]
+  ],
+  "before_line": 21,
+  "before_mapped": true,
+  "after": [
+   [
+    16,
+    " * - http://localhost:8080/subjects/fantasy#sort=date_published&ebooks=true"
+   ],
+   [
+    17,
+    " * - http://localhost:8080/publishers/Barnes_&_Noble"
+   ],
+   [
+    18,
+    " */"
+   ],
+   [
+    19,
+    "export function loadEditionsGraph() {"
+   ],
+   [
+    20,
+    "    var data, options, placeholder, plot, dateFrom, dateTo, previousPoint;"
+   ],
+   [
+    21,
+    "    data = [{ data: JSON.parse(document.getElementById('graph-json-chartPubHistory').textContent) }];"
+   ],
+   [
+    22,
+    "    options = {"
+   ],
+   [
+    23,
+    "        series: {"
+   ],
+   [
+    24,
+    "            bars: {"
+   ]
+  ],
+  "diff": "@@ -17,9 +17,8 @@ import 'flot/jquery.flot.time.js';\n  * - http://localhost:8080/publishers/Barnes_&_Noble\n  */\n export function loadEditionsGraph() {\n-    var data, options, placeholder,\n-        plot, dateFrom, dateTo, previousPoint;\n-    data = [{data: JSON.parse(document.getElementById('graph-json-chartPubHistory').textContent)}];\n+    var data, options, placeholder, plot, dateFrom, dateTo, previousPoint;\n+    data = [{ data: JSON.parse(document.getElementById('graph-json-chartPubHistory').textContent) }];\n     options = {\n         series: {\n             bars: {"
+ },
+ {
+  "item": "F073",
+  "kind": "introduced",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/342d0cbdf0c5435b715dc9f1917b851e413e08e3",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "packages/hoppscotch-common/src/lib/sync/collections/index.ts",
+  "old_path": "packages/hoppscotch-common/src/lib/sync/collections/index.ts",
+  "old_line": null,
+  "line": 384,
+  "before": [
+   [
+    266,
+    "      res.right.exportUserCollectionsToJSON.exportedCollection"
+   ],
+   [
+    267,
+    "    const exportedCollections = ("
+   ],
+   [
+    268,
+    "      JSON.parse(collectionsJSONString) as Array<"
+   ],
+   [
+    269,
+    "        ExportedUserCollectionGQL | ExportedUserCollectionREST"
+   ],
+   [
+    270,
+    "      >"
+   ],
+   [
+    271,
+    "    ).map((collection) => ({ v: 1, ...collection }))"
+   ],
+   [
+    272,
+    "    runDispatchWithOutSyncing(() => {"
+   ],
+   [
+    273,
+    "      collectionType == \"REST\""
+   ],
+   [
+    274,
+    "        ? setRESTCollections("
+   ],
+   [
+    275,
+    "            exportedCollections.map("
+   ],
+   [
+    276,
+    "              (collection) =>"
+   ],
+   [
+    277,
+    "                exportedCollectionToHoppCollection("
+   ],
+   [
+    278,
+    "                  collection,"
+   ]
+  ],
+  "before_line": 272,
+  "before_mapped": false,
+  "after": [
+   [
+    380,
+    "        ) as HoppCollection"
+   ],
+   [
+    381,
+    "    )"
+   ],
+   [
+    382,
+    ""
+   ],
+   [
+    383,
+    "    const localCollections ="
+   ],
+   [
+    384,
+    "      collectionType == \"REST\""
+   ],
+   [
+    385,
+    "        ? restCollectionStore.value.state"
+   ],
+   [
+    386,
+    "        : graphqlCollectionStore.value.state"
+   ],
+   [
+    387,
+    ""
+   ],
+   [
+    388,
+    "    const mergedCollections = mergeCollections(localCollections, fetchedCollections)"
+   ]
+  ],
+  "diff": "@@ -269,26 +371,26 @@ async function loadUserCollections(collectionType: \"REST\" | \"GQL\") {\n         ExportedUserCollectionGQL | ExportedUserCollectionREST\n       >\n     ).map((collection) => ({ v: 1, ...collection }))\n+\n+    const fetchedCollections = exportedCollections.map(\n+      (collection) =>\n+        exportedCollectionToHoppCollection(\n+          collection,\n+          collectionType\n+        ) as HoppCollection\n+    )\n+\n+    const localCollections =\n+      collectionType == \"REST\"\n+        ? restCollectionStore.value.state\n+        : graphqlCollectionStore.value.state\n+\n+    const mergedCollections = mergeCollections(localCollections, fetchedCollections)\n+\n     runDispatchWithOutSyncing(() => {\n       collectionType == \"REST\"\n-        ? setRESTCollections(\n-            exportedCollections.map(\n-              (collection) =>\n-                exportedCollectionToHoppCollection(\n-                  collection,\n-                  \"REST\"\n-                ) as HoppCollection\n-            )\n-          )\n-        : setGraphqlCollections(\n-            exportedCollections.map(\n-              (collection) =>\n-                exportedCollectionToHoppCollection(\n-                  collection,\n-                  \"GQL\"\n-                ) as HoppCollection\n-            )\n-          )\n... (6 more lines)"
+ },
+ {
+  "item": "F074",
+  "kind": "introduced",
+  "repository": "uptime-kuma",
+  "commit_url": "https://github.com/louislam/uptime-kuma/commit/e62702d868a0b072c6e1870e5278762319637f04",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "server/notification-providers/indigo.js",
+  "old_path": "server/notification-providers/indigo.js",
+  "old_line": null,
+  "line": 52,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    48,
+    "            }"
+   ],
+   [
+    49,
+    "            config = this.getAxiosConfigWithProxy(config);"
+   ],
+   [
+    50,
+    ""
+   ],
+   [
+    51,
+    "            for (const command of commands) {"
+   ],
+   [
+    52,
+    "                const result = await axios.post(url, { id: \"uptime-kuma\", ...command }, config);"
+   ],
+   [
+    53,
+    "                if (result.data?.error || result.data?.validationErrors) {"
+   ],
+   [
+    54,
+    "                    throw new Error("
+   ],
+   [
+    55,
+    "                        `Indigo rejected ${command.message}: ${result.data.error || JSON.stringify(result.data.validationErrors)}`"
+   ],
+   [
+    56,
+    "                    );"
+   ]
+  ],
+  "diff": "@@ -0,0 +1,67 @@\n+const NotificationProvider = require(\"./notification-provider\");\n+const axios = require(\"axios\");\n+const https = require(\"https\");\n+\n+class Indigo extends NotificationProvider {\n+    name = \"Indigo\";\n+\n+    /**\n+     * @inheritdoc\n+     */\n+    async send(notification, msg, monitorJSON = null, heartbeatJSON = null) {\n+        const okMsg = \"Sent Successfully.\";\n+        const url = `${notification.indigoUrl.trim().replace(/\\/*$/, \"\")}/v2/api/command`;\n+        const variableId = parseInt(notification.indigoVariableId);\n+        const actionGroupId = parseInt(notification.indigoActionGroupId);\n+\n+        if (!variableId && !actionGroupId) {\n+            throw new Error(\"Set an Indigo variable ID, an action group ID, or both.\");\n+        }\n+\n+        // The variable is written first so the action group can read it.\n+        const commands = [];\n+        if (variableId) {\n+            commands.push({\n+                message: \"indigo.variable.updateValue\",\n+                objectId: variableId,\n+                parameters: { value: msg },\n+            });\n+        }\n+        if (actionGroupId) {\n+            commands.push({\n+                message: \"indigo.actionGroup.execute\",\n+                objectId: actionGroupId,\n+            });\n+        }\n+\n+        try {\n+            let config = {\n+                headers: {\n... (29 more lines)"
+ },
+ {
+  "item": "F075",
+  "kind": "pair",
+  "repository": "openlibrary",
+  "commit_url": "https://github.com/internetarchive/openlibrary/commit/f5aff19fb7d0c27f3bb91f08db81a8750bae604a",
+  "rule": "CG-SEC-001",
+  "rule_title": "SQL query built with string formatting",
+  "path": "openlibrary/tests/core/test_bookshelves_events_async.py",
+  "old_path": "openlibrary/tests/core/test_bookshelves_events_async.py",
+  "old_line": 48,
+  "line": 136,
+  "before": [
+   [
+    44,
+    "                    \"VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    45,
+    "                    {\"u\": \"alice\", \"w\": work_id, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2026-05-01\"},"
+   ],
+   [
+    46,
+    "                )"
+   ],
+   [
+    47,
+    "            # Duplicate on 101 stays distinct. START and 2025 rows must not count."
+   ],
+   [
+    48,
+    "            await conn.execute("
+   ],
+   [
+    49,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    50,
+    "                {\"u\": \"alice\", \"w\": 101, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2026-06-01\"},"
+   ],
+   [
+    51,
+    "            )"
+   ],
+   [
+    52,
+    "            await conn.execute("
+   ]
+  ],
+  "before_line": 48,
+  "before_mapped": true,
+  "after": [
+   [
+    132,
+    "                    \"VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    133,
+    "                    {\"u\": \"alice\", \"w\": work_id, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2026-05-01\"},"
+   ],
+   [
+    134,
+    "                )"
+   ],
+   [
+    135,
+    "            # Duplicate on 101 stays distinct. START and 2025 rows must not count."
+   ],
+   [
+    136,
+    "            await conn.execute("
+   ],
+   [
+    137,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    138,
+    "                {\"u\": \"alice\", \"w\": 101, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2026-06-01\"},"
+   ],
+   [
+    139,
+    "            )"
+   ],
+   [
+    140,
+    "            await conn.execute("
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F076",
+  "kind": "introduced",
+  "repository": "healthchecks",
+  "commit_url": "https://github.com/healthchecks/healthchecks/commit/cb1926bedaeca358a644e3096cd47d80648abfd3",
+  "rule": "CG-QUAL-004",
+  "rule_title": "Code is nested too deeply",
+  "path": "hc/integrations/telegram/transport.py",
+  "old_path": "hc/integrations/telegram/transport.py",
+  "old_line": null,
+  "line": 30,
+  "before": [
+   [
+    24,
+    ""
+   ],
+   [
+    25,
+    "    class ErrorModel(BaseModel):"
+   ],
+   [
+    26,
+    "        description: str"
+   ],
+   [
+    27,
+    "        parameters: Telegram.MigrationParameters | None = None"
+   ],
+   [
+    28,
+    ""
+   ],
+   [
+    29,
+    "    @classmethod"
+   ],
+   [
+    30,
+    "    def raise_for_response(cls, response: curl.Response) -> NoReturn:"
+   ],
+   [
+    31,
+    "        message = f\"Received status code {response.status_code}\""
+   ],
+   [
+    32,
+    "        try:"
+   ],
+   [
+    33,
+    "            m = Telegram.ErrorModel.model_validate_json(response.content)"
+   ],
+   [
+    34,
+    "        except ValidationError:"
+   ],
+   [
+    35,
+    "            raise TransportError(message)"
+   ],
+   [
+    36,
+    ""
+   ]
+  ],
+  "before_line": 30,
+  "before_mapped": true,
+  "after": [
+   [
+    26,
+    "        description: str"
+   ],
+   [
+    27,
+    "        parameters: Telegram.MigrationParameters | None = None"
+   ],
+   [
+    28,
+    ""
+   ],
+   [
+    29,
+    "    @classmethod"
+   ],
+   [
+    30,
+    "    def raise_for_response(cls, response: curl.Response) -> NoReturn:"
+   ],
+   [
+    31,
+    "        message = f\"Received status code {response.status_code}\""
+   ],
+   [
+    32,
+    "        try:"
+   ],
+   [
+    33,
+    "            m = Telegram.ErrorModel.model_validate_json(response.content)"
+   ],
+   [
+    34,
+    "        except ValidationError:"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F077",
+  "kind": "introduced",
+  "repository": "healthchecks",
+  "commit_url": "https://github.com/healthchecks/healthchecks/commit/b83e3791d6e2c276a13c0b40c2e435c6ec01125c",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "hc/integrations/po/static/js/add_pushover.js",
+  "old_path": "hc/integrations/po/static/js/add_pushover.js",
+  "old_line": null,
+  "line": 7,
+  "before": [
+   [
+    1,
+    "$(function() {"
+   ],
+   [
+    2,
+    "    function makeOption(item, escape) {"
+   ],
+   [
+    3,
+    "        var parts = item.text.split(\":\");"
+   ],
+   [
+    4,
+    "        return `<div class=\"option\">${parts[0]}. <span class=\"help\">${parts[1]}</span></div>`;"
+   ],
+   [
+    5,
+    "    }"
+   ],
+   [
+    6,
+    ""
+   ],
+   [
+    7,
+    "    $(\"select\").selectize({render: {option: makeOption, item: makeOption}});"
+   ],
+   [
+    8,
+    "});"
+   ]
+  ],
+  "before_line": 7,
+  "before_mapped": false,
+  "after": [
+   [
+    3,
+    "        var parts = item.text.split(\":\");"
+   ],
+   [
+    4,
+    "        return `<div>${parts[0]}. <span class=\"help\">${parts[1]}</span></div>`;"
+   ],
+   [
+    5,
+    "    }"
+   ],
+   [
+    6,
+    ""
+   ],
+   [
+    7,
+    "    var config = {"
+   ],
+   [
+    8,
+    "        maxItems: 1,"
+   ],
+   [
+    9,
+    "        controlInput: null,"
+   ],
+   [
+    10,
+    "        plugins: [\"no_backspace_delete\"],"
+   ],
+   [
+    11,
+    "        render: {option: makeOption, item: makeOption},"
+   ]
+  ],
+  "diff": "@@ -1,8 +1,17 @@\n $(function() {\n     function makeOption(item, escape) {\n         var parts = item.text.split(\":\");\n-        return `<div class=\"option\">${parts[0]}. <span class=\"help\">${parts[1]}</span></div>`;\n+        return `<div>${parts[0]}. <span class=\"help\">${parts[1]}</span></div>`;\n     }\n\n-    $(\"select\").selectize({render: {option: makeOption, item: makeOption}});\n+    var config = {\n+        maxItems: 1,\n+        controlInput: null,\n+        plugins: [\"no_backspace_delete\"],\n+        render: {option: makeOption, item: makeOption},\n+    };\n+\n+    document.querySelectorAll(\"select\").forEach((el) => {\n+        new TomSelect(el, config)\n+    });\n });\n\\ No newline at end of file\n"
+ },
+ {
+  "item": "F078",
+  "kind": "introduced",
+  "repository": "lnbits",
+  "commit_url": "https://github.com/lnbits/lnbits/commit/653924a6dcb6d821a9dae32cd9aac5d287351c57",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "lnbits/static/i18n/fo.js",
+  "old_path": "lnbits/static/i18n/fo.js",
+  "old_line": null,
+  "line": 300,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    296,
+    "  notifications_configure: 'Fr\u00e1bo\u00f0anaruppsetan',"
+   ],
+   [
+    297,
+    "  notifications_nostr_config: 'Nostr uppsetan',"
+   ],
+   [
+    298,
+    "  notifications_enable_nostr: 'Virkja Nostr fr\u00e1bo\u00f0anir',"
+   ],
+   [
+    299,
+    "  notifications_enable_nostr_desc: 'Send fr\u00e1bo\u00f0anir umvegis Nostr',"
+   ],
+   [
+    300,
+    "  notifications_nostr_private_key: 'Nostr privatur lykil',"
+   ],
+   [
+    301,
+    "  notifications_nostr_private_key_desc:"
+   ],
+   [
+    302,
+    "    'Privatur lykil, \u00ed sekstandatal ella nsec skapi, at undirrita bo\u00f0 send til Nostr',"
+   ],
+   [
+    303,
+    "  notifications_nostr_identifier: 'Nostr-d\u00e1tuheiti',"
+   ],
+   [
+    304,
+    "  notifications_nostr_identifier_desc:"
+   ]
+  ],
+  "diff": "@@ -0,0 +1,901 @@\n+window.localisation.fo = {\n+  confirm: 'Ja',\n+  server: 'Amb\u00e6tari',\n+  theme: 'Sni\u00f0',\n+  site_customisation: 'Vevs\u00ed\u00f0u tillagingar',\n+  funding: 'F\u00edgging',\n+  users: 'Br\u00fakarar',\n+  audit: 'Sl\u00f3\u00f0festi',\n+  api_watch: 'API n\u00fdtsluyvirlit',\n+  apps: 'Appir',\n+  channels: 'R\u00e1sir',\n+  transactions: 'Flytingar',\n+  dashboard: 'Yvirlitss\u00fdni',\n+  node: 'Kn\u00fatur',\n+  export_users: 'Tak br\u00fakarar \u00fat',\n+  no_users: 'Eingin br\u00fakari finst',\n+  total_capacity: 'Samla\u00f0 r\u00e1sarupph\u00e6dd',\n+  avg_channel_size: 'Mi\u00f0al r\u00e1sarupph\u00e6dd',\n+  biggest_channel_size: 'St\u00f8rsta r\u00e1sarupph\u00e6dd',\n+  smallest_channel_size: 'Minsta r\u00e1sarupph\u00e6dd',\n+  number_of_channels: 'Tal av r\u00e1sum',\n+  active_channels: 'Virknar r\u00e1sir',\n+  connect_peer: 'Sambind vi\u00f0 javninga',\n+  connect: 'Sambind',\n+  reconnect: 'Sambind aftur',\n+  open_channel: 'Ger r\u00e1s',\n+  open: 'Lat upp',\n+  clear: 'T\u00f3mstilla',\n+  close_channel: 'Loka r\u00e1s',\n+  close: 'Loka',\n+  restart: 'Endurbyrja amb\u00e6tara',\n+  image_library: 'Myndasavn',\n+  save: 'Goym',\n+  save_tooltip: 'Goym broytingarnar',\n+  must_save: 'T\u00fa hevur framt broytingar i\u00f0 enn ikki eru goymdar.',\n+  credit_debit: 'G\u00f3\u00f0skriva / Skuldskriva',\n+  credit_hint:\n+    'Tr\u00fdst \u00e1 Enter til tess at g\u00f3\u00f0skriva/skuldskriva mappu (negativ vi\u00f0ri eru loyvd)',\n+  credit_label: '{denomination} at g\u00f3\u00f0skriva/skuldskriva',\n... (863 more lines)"
+ },
+ {
+  "item": "F079",
+  "kind": "pair",
+  "repository": "openlibrary",
+  "commit_url": "https://github.com/internetarchive/openlibrary/commit/f5aff19fb7d0c27f3bb91f08db81a8750bae604a",
+  "rule": "CG-SEC-001",
+  "rule_title": "SQL query built with string formatting",
+  "path": "openlibrary/tests/core/test_bookshelves_events_async.py",
+  "old_path": "openlibrary/tests/core/test_bookshelves_events_async.py",
+  "old_line": 56,
+  "line": 144,
+  "before": [
+   [
+    52,
+    "            await conn.execute("
+   ],
+   [
+    53,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    54,
+    "                {\"u\": \"alice\", \"w\": 104, \"e\": 1, \"t\": BookshelfEvent.START, \"d\": \"2026-05-01\"},"
+   ],
+   [
+    55,
+    "            )"
+   ],
+   [
+    56,
+    "            await conn.execute("
+   ],
+   [
+    57,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    58,
+    "                {\"u\": \"alice\", \"w\": 105, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2025-05-01\"},"
+   ],
+   [
+    59,
+    "            )"
+   ],
+   [
+    60,
+    ""
+   ]
+  ],
+  "before_line": 56,
+  "before_mapped": true,
+  "after": [
+   [
+    140,
+    "            await conn.execute("
+   ],
+   [
+    141,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    142,
+    "                {\"u\": \"alice\", \"w\": 104, \"e\": 1, \"t\": BookshelfEvent.START, \"d\": \"2026-05-01\"},"
+   ],
+   [
+    143,
+    "            )"
+   ],
+   [
+    144,
+    "            await conn.execute("
+   ],
+   [
+    145,
+    "                f\"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)\","
+   ],
+   [
+    146,
+    "                {\"u\": \"alice\", \"w\": 105, \"e\": 1, \"t\": BookshelfEvent.FINISH, \"d\": \"2025-05-01\"},"
+   ],
+   [
+    147,
+    "            )"
+   ],
+   [
+    148,
+    ""
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F080",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": 2622,
+  "line": 3308,
+  "before": [
+   [
+    2618,
+    "                  getMockBookingReference({"
+   ],
+   [
+    2619,
+    "                    type: \"google_calendar\","
+   ],
+   [
+    2620,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    2621,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    2622,
+    "                    meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    2623,
+    "                    meetingUrl: \"http://mock-google-meet.example.com\","
+   ],
+   [
+    2624,
+    "                    externalCalendarId: \"MOCK_EXTERNAL_CALENDAR_ID\","
+   ],
+   [
+    2625,
+    "                    credentialId: 1,"
+   ],
+   [
+    2626,
+    "                  }),"
+   ]
+  ],
+  "before_line": 2622,
+  "before_mapped": true,
+  "after": [
+   [
+    3304,
+    "                  getMockBookingReference({"
+   ],
+   [
+    3305,
+    "                    type: \"google_calendar\","
+   ],
+   [
+    3306,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    3307,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    3308,
+    "                    meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    3309,
+    "                    meetingUrl: \"http://mock-google-meet.example.com\","
+   ],
+   [
+    3310,
+    "                    externalCalendarId: \"MOCK_EXTERNAL_CALENDAR_ID\","
+   ],
+   [
+    3311,
+    "                    credentialId: 1,"
+   ],
+   [
+    3312,
+    "                  }),"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F081",
+  "kind": "introduced",
+  "repository": "pgadmin",
+  "commit_url": "https://github.com/pgadmin-org/pgadmin4/commit/a4bdcff7dc65e1b667b981574a7c7263bc84afd2",
+  "rule": "CG-QUAL-101",
+  "rule_title": "Loose equality (== / !=)",
+  "path": "web/pgadmin/misc/cloud/static/js/cloud_components.jsx",
+  "old_path": "web/pgadmin/misc/cloud/static/js/cloud_components.jsx",
+  "old_line": null,
+  "line": 58,
+  "before": [
+   [
+    51,
+    ""
+   ],
+   [
+    52,
+    ""
+   ],
+   [
+    53,
+    "export function FinalSummary(props) {"
+   ],
+   [
+    54,
+    "  let summary = [],"
+   ],
+   [
+    55,
+    "    summaryHeader = ['Cloud Details', 'Version and Instance Details', 'Storage Details', 'Database Details'];"
+   ],
+   [
+    56,
+    ""
+   ],
+   [
+    57,
+    "  if(props.cloudProvider == 'azure') {"
+   ],
+   [
+    58,
+    "    summaryHeader.push('Network Connectivity','Availability');"
+   ],
+   [
+    59,
+    "    summary = getAzureSummary(props.cloudProvider, props.instanceData, props.databaseData);"
+   ],
+   [
+    60,
+    "  }else if(props.cloudProvider == 'google') {"
+   ],
+   [
+    61,
+    "    summaryHeader.push('Network Connectivity','Availability');"
+   ],
+   [
+    62,
+    "    summary = getGoogleSummary(props.cloudProvider, props.instanceData, props.databaseData);"
+   ],
+   [
+    63,
+    "  }else {"
+   ]
+  ],
+  "before_line": 57,
+  "before_mapped": false,
+  "after": [
+   [
+    54,
+    "export function FinalSummary(props) {"
+   ],
+   [
+    55,
+    "  let summary = [],"
+   ],
+   [
+    56,
+    "    summaryHeader = ['Cloud Details', 'Version and Instance Details', 'Storage Details', 'Database Details'];"
+   ],
+   [
+    57,
+    ""
+   ],
+   [
+    58,
+    "  if(props.cloudProvider == 'starfleet') {"
+   ],
+   [
+    59,
+    "    summaryHeader = ['Cloud Details', 'Network Connectivity'];"
+   ],
+   [
+    60,
+    "    summary = getStarfleetSummary(props.cloudProvider, props.instanceData, props.databaseData);"
+   ],
+   [
+    61,
+    "  }else if(props.cloudProvider == 'azure') {"
+   ],
+   [
+    62,
+    "    summaryHeader.push('Network Connectivity','Availability');"
+   ]
+  ],
+  "diff": "@@ -54,7 +55,10 @@ export function FinalSummary(props) {\n   let summary = [],\n     summaryHeader = ['Cloud Details', 'Version and Instance Details', 'Storage Details', 'Database Details'];\n\n-  if(props.cloudProvider == 'azure') {\n+  if(props.cloudProvider == 'starfleet') {\n+    summaryHeader = ['Cloud Details', 'Network Connectivity'];\n+    summary = getStarfleetSummary(props.cloudProvider, props.instanceData, props.databaseData);\n+  }else if(props.cloudProvider == 'azure') {\n     summaryHeader.push('Network Connectivity','Availability');\n     summary = getAzureSummary(props.cloudProvider, props.instanceData, props.databaseData);\n   }else if(props.cloudProvider == 'google') {\n"
+ },
+ {
+  "item": "F082",
+  "kind": "pair",
+  "repository": "kitsune",
+  "commit_url": "https://github.com/mozilla/kitsune/commit/59b6937db573505c764bec9c87bd786981848487",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_path": "kitsune/sumo/static/sumo/js/markup.js",
+  "old_line": 965,
+  "line": 969,
+  "before": [
+   [
+    961,
+    "      });"
+   ],
+   [
+    962,
+    "    }"
+   ],
+   [
+    963,
+    ""
+   ],
+   [
+    964,
+    "    function loadCannedResponses() {"
+   ],
+   [
+    965,
+    "      var siteLanguage = window.location.pathname.split(\"/\")[1];"
+   ],
+   [
+    966,
+    "      var targetUrl = \"/\" + siteLanguage + cannedResponsesUrl;"
+   ],
+   [
+    967,
+    ""
+   ],
+   [
+    968,
+    "      apiFetch(targetUrl, { method: \"GET\", dataType: \"html\" })"
+   ],
+   [
+    969,
+    "        .then(function (responseHtml) {"
+   ]
+  ],
+  "before_line": 965,
+  "before_mapped": true,
+  "after": [
+   [
+    965,
+    "      });"
+   ],
+   [
+    966,
+    "    }"
+   ],
+   [
+    967,
+    ""
+   ],
+   [
+    968,
+    "    function loadCannedResponses() {"
+   ],
+   [
+    969,
+    "      var siteLanguage = window.location.pathname.split(\"/\")[1];"
+   ],
+   [
+    970,
+    "      var targetUrl = \"/\" + siteLanguage + cannedResponsesUrl;"
+   ],
+   [
+    971,
+    ""
+   ],
+   [
+    972,
+    "      apiFetch(targetUrl, { method: \"GET\", dataType: \"html\" })"
+   ],
+   [
+    973,
+    "        .then(function (responseHtml) {"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F083",
+  "kind": "introduced",
+  "repository": "openlibrary",
+  "commit_url": "https://github.com/internetarchive/openlibrary/commit/ff9577a078ac1492c1ce4cef0bd53b69e98a692e",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "openlibrary/bookworm/cli.py",
+  "old_path": "openlibrary/bookworm/cli.py",
+  "old_line": null,
+  "line": 406,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    402,
+    "        return MATCHED_EXPECTED, matched_key, expected"
+   ],
+   [
+    403,
+    "    return MATCHED_OTHER, matched_key, expected"
+   ],
+   [
+    404,
+    ""
+   ],
+   [
+    405,
+    ""
+   ],
+   [
+    406,
+    "def preview_command("
+   ],
+   [
+    407,
+    "    ol_config: str = \"/openlibrary/conf/openlibrary.yml\","
+   ],
+   [
+    408,
+    "    provider: str = \"\","
+   ],
+   [
+    409,
+    "    limit: int | None = None,"
+   ],
+   [
+    410,
+    "    expect_edition_ids: bool = True,"
+   ]
+  ],
+  "diff": "@@ -0,0 +1,520 @@\n+#!/usr/bin/env python\n+\"\"\"Command line for the BookWorm feed harvest (#12844).\n+\n+Three commands, all needing ``--ol-config`` because it supplies both the\n+database connection and -- on hosts that egress through a proxy -- the settings\n+without which no provider feed is reachable at all::\n+\n+    python -m openlibrary.bookworm.cli harvest  --ol-config /olsystem/etc/openlibrary.yml\n+    python -m openlibrary.bookworm.cli register --ol-config /olsystem/etc/openlibrary.yml --show\n+    python -m openlibrary.bookworm.cli preview  --ol-config /olsystem/etc/openlibrary.yml --provider lenny\n+\n+``harvest`` is the cron entrypoint: one pass over every active feed, then exit,\n+so the crontab can see a non-zero status. ``register`` puts the feed list in git\n+rather than in hand-typed SQL. ``preview`` reports what the catalog would match\n+without writing anything, for diagnosing a feed that looks wrong.\n+\n+Run ``<command> --help`` for each one's options. The harvest logic itself is in\n+``harvest.py``; this module is only the interface to it.\n+\"\"\"\n+\n+import datetime\n+import logging\n+import sys\n+import time\n+from collections import Counter\n+from collections.abc import Callable\n+from urllib.parse import urlparse\n+\n+from infogami import config\n+from openlibrary.bookworm import harvest\n+from openlibrary.bookworm.registry import (\n+    CURSOR_MODIFIED_SINCE,\n+    STATUS_ACTIVE,\n+    FeedRegistry,\n+)\n+from openlibrary.catalog.add_book import load\n+from openlibrary.config import load_config\n+from openlibrary.plugins.upstream.utils import setup_requests\n+from scripts.solr_builder.solr_builder.fn_to_cli import FnToCLI\n... (482 more lines)"
+ },
+ {
+  "item": "F084",
+  "kind": "pair",
+  "repository": "habitica",
+  "commit_url": "https://github.com/HabitRPG/habitica/commit/e6ffd69148396eeff7130b102a93d774fa11dcbc",
+  "rule": "CG-QUAL-103",
+  "rule_title": "Function is too complex",
+  "path": "website/common/script/ops/buy/purchase.js",
+  "old_path": "website/common/script/ops/buy/purchase.js",
+  "old_line": 79,
+  "line": 79,
+  "before": [
+   [
+    75,
+    "}"
+   ],
+   [
+    76,
+    ""
+   ],
+   [
+    77,
+    "const acceptedTypes = ['eggs', 'hatchingPotions', 'food', 'gear', 'bundles'];"
+   ],
+   [
+    78,
+    "const singlePurchaseTypes = ['gear'];"
+   ],
+   [
+    79,
+    "export default async function purchase (user, req = {}, analytics) {"
+   ],
+   [
+    80,
+    "  const type = get(req.params, 'type');"
+   ],
+   [
+    81,
+    "  const key = get(req.params, 'key');"
+   ],
+   [
+    82,
+    ""
+   ],
+   [
+    83,
+    "  const quantity = req.quantity ? Number(req.quantity) : 1;"
+   ]
+  ],
+  "before_line": 79,
+  "before_mapped": true,
+  "after": [
+   [
+    75,
+    "}"
+   ],
+   [
+    76,
+    ""
+   ],
+   [
+    77,
+    "const acceptedTypes = ['eggs', 'hatchingPotions', 'food', 'gear', 'bundles'];"
+   ],
+   [
+    78,
+    "const singlePurchaseTypes = ['gear'];"
+   ],
+   [
+    79,
+    "export default async function purchase (user, req = {}) {"
+   ],
+   [
+    80,
+    "  const type = get(req.params, 'type');"
+   ],
+   [
+    81,
+    "  const key = get(req.params, 'key');"
+   ],
+   [
+    82,
+    ""
+   ],
+   [
+    83,
+    "  const quantity = req.quantity ? Number(req.quantity) : 1;"
+   ]
+  ],
+  "diff": "@@ -76,7 +76,7 @@ async function purchaseItem (user, item, price, type, key) {\n\n const acceptedTypes = ['eggs', 'hatchingPotions', 'food', 'gear', 'bundles'];\n const singlePurchaseTypes = ['gear'];\n-export default async function purchase (user, req = {}, analytics) {\n+export default async function purchase (user, req = {}) {\n   const type = get(req.params, 'type');\n   const key = get(req.params, 'key');\n"
+ },
+ {
+  "item": "F085",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": 2494,
+  "line": 3180,
+  "before": [
+   [
+    2490,
+    "                  {"
+   ],
+   [
+    2491,
+    "                    type: appStoreMetadata.googlecalendar.type,"
+   ],
+   [
+    2492,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    2493,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    2494,
+    "                    meetingPassword: \"MOCK_PASSWORD\","
+   ],
+   [
+    2495,
+    "                    meetingUrl: \"https://UNUSED_URL\","
+   ],
+   [
+    2496,
+    "                    externalCalendarId: \"MOCK_EXTERNAL_CALENDAR_ID\","
+   ],
+   [
+    2497,
+    "                    credentialId: undefined,"
+   ],
+   [
+    2498,
+    "                  },"
+   ]
+  ],
+  "before_line": 2494,
+  "before_mapped": true,
+  "after": [
+   [
+    3176,
+    "                  {"
+   ],
+   [
+    3177,
+    "                    type: appStoreMetadata.googlecalendar.type,"
+   ],
+   [
+    3178,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    3179,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    3180,
+    "                    meetingPassword: \"MOCK_PASSWORD\","
+   ],
+   [
+    3181,
+    "                    meetingUrl: \"https://UNUSED_URL\","
+   ],
+   [
+    3182,
+    "                    externalCalendarId: \"MOCK_EXTERNAL_CALENDAR_ID\","
+   ],
+   [
+    3183,
+    "                    credentialId: undefined,"
+   ],
+   [
+    3184,
+    "                  },"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F086",
+  "kind": "introduced",
+  "repository": "hoppscotch",
+  "commit_url": "https://github.com/hoppscotch/hoppscotch/commit/e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "packages/hoppscotch-common/src/services/ai-chat.service.ts",
+  "old_path": "packages/hoppscotch-common/src/services/ai-chat.service.ts",
+  "old_line": null,
+  "line": 4893,
+  "before": [
+   [
+    1,
+    ""
+   ]
+  ],
+  "before_line": 1,
+  "before_mapped": false,
+  "after": [
+   [
+    4889,
+    "        )"
+   ],
+   [
+    4890,
+    "      } else {"
+   ],
+   [
+    4891,
+    "        request._ref_id = generateUniqueRefId(\"req\")"
+   ],
+   [
+    4892,
+    "        delete (request as { id?: string }).id"
+   ],
+   [
+    4893,
+    "        const res = await createRequestInCollection(found.node.id, {"
+   ],
+   [
+    4894,
+    "          request: JSON.stringify(request),"
+   ],
+   [
+    4895,
+    "          teamID,"
+   ],
+   [
+    4896,
+    "          title: request.name,"
+   ],
+   [
+    4897,
+    "        })()"
+   ]
+  ],
+  "diff": "@@ -0,0 +1,6825 @@\n+import { Service } from \"dioc\"\n+import {\n+  computed,\n+  nextTick,\n+  ref,\n+  shallowRef,\n+  watch,\n+  type ShallowRef,\n+} from \"vue\"\n+import * as E from \"fp-ts/Either\"\n+import type {\n+  HoppCollection,\n+  HoppCollectionVariable,\n+  HoppGQLRequest,\n+  HoppRESTAuth,\n+  HoppRESTHeader,\n+  HoppRESTRequest,\n+} from \"@hoppscotch/data\"\n+import { populateValuesInInheritedCollectionVars } from \"~/helpers/utils/inheritedCollectionVarTransformer\"\n+import {\n+  Environment,\n+  EnvironmentSchemaVersion,\n+  generateUniqueRefId,\n+  isRESTRequest,\n+  makeCollection,\n+  translateToNewEnvironmentVariables,\n+} from \"@hoppscotch/data\"\n+import { pipe } from \"fp-ts/function\"\n+import * as TE from \"fp-ts/TaskEither\"\n+import { TeamCollectionsService } from \"~/services/team-collection.service\"\n+import type { TeamCollection } from \"~/helpers/teams/TeamCollection\"\n+import type { TeamRequest } from \"~/helpers/teams/TeamRequest\"\n+import type { TeamEnvironment } from \"~/helpers/teams/TeamEnvironment\"\n+import type { HoppInheritedProperty } from \"~/helpers/types/HoppInheritedProperties\"\n+import {\n+  getCompleteCollectionTree,\n+  teamCollToHoppRESTColl,\n+} from \"~/helpers/backend/helpers\"\n+import {\n... (6787 more lines)"
+ },
+ {
+  "item": "F087",
+  "kind": "pair",
+  "repository": "ghost",
+  "commit_url": "https://github.com/TryGhost/Ghost/commit/0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "tools/scripts/check-internal-packages.ts",
+  "old_path": "tools/scripts/check-internal-packages.ts",
+  "old_line": 285,
+  "line": 339,
+  "before": [
+   [
+    281,
+    "        conditions.default,"
+   ],
+   [
+    282,
+    "        `./build/${sourceStem}.js`,"
+   ],
+   [
+    283,
+    "        `exports.${entryPoint}.default`,"
+   ],
+   [
+    284,
+    "      );"
+   ],
+   [
+    285,
+    "      if (!(await exists(path.join(packageDirectory, conditions.source)))) {"
+   ],
+   [
+    286,
+    "        errors.push("
+   ],
+   [
+    287,
+    "          `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source})`,"
+   ],
+   [
+    288,
+    "        );"
+   ],
+   [
+    289,
+    "      }"
+   ]
+  ],
+  "before_line": 285,
+  "before_mapped": true,
+  "after": [
+   [
+    335,
+    "        conditions.default,"
+   ],
+   [
+    336,
+    "        `./build/${sourceStem}.js`,"
+   ],
+   [
+    337,
+    "        `exports.${entryPoint}.default`,"
+   ],
+   [
+    338,
+    "      );"
+   ],
+   [
+    339,
+    "      if (!(await exists(path.join(packageDirectory, conditions.source as string)))) {"
+   ],
+   [
+    340,
+    "        errors.push("
+   ],
+   [
+    341,
+    "          `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source as string})`,"
+   ],
+   [
+    342,
+    "        );"
+   ],
+   [
+    343,
+    "      }"
+   ]
+  ],
+  "diff": "@@ -282,14 +336,14 @@ async function validateCompliantPackage({\n         `./build/${sourceStem}.js`,\n         `exports.${entryPoint}.default`,\n       );\n-      if (!(await exists(path.join(packageDirectory, conditions.source)))) {\n+      if (!(await exists(path.join(packageDirectory, conditions.source as string)))) {\n         errors.push(\n-          `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source})`,\n+          `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source as string})`,\n         );\n       }\n     }\n\n-    const rootExport = exports['.'];\n+    const rootExport = (exports as JsonObject)['.'] as JsonObject | undefined;\n     if (!rootExport) {\n       errors.push(`${manifestPath}: exports must define the \".\" entry point`);\n     } else {"
+ },
+ {
+  "item": "F088",
+  "kind": "pair",
+  "repository": "hedgedoc",
+  "commit_url": "https://github.com/hedgedoc/hedgedoc/commit/c2ccf48c3966608f7292c6818d1b95469aa1b3cd",
+  "rule": "CG-PERF-101",
+  "rule_title": "await inside a loop runs the iterations one after another",
+  "path": "backend/src/api/public/notes/notes.controller.ts",
+  "old_path": "backend/src/api/public/notes/notes.controller.ts",
+  "old_line": 134,
+  "line": 134,
+  "before": [
+   [
+    130,
+    "    for (const mediaUpload of mediaUploads) {"
+   ],
+   [
+    131,
+    "      if (!noteMediaDeletionDto.keepMedia) {"
+   ],
+   [
+    132,
+    "        await this.mediaService.deleteFile(mediaUpload);"
+   ],
+   [
+    133,
+    "      } else {"
+   ],
+   [
+    134,
+    "        await this.mediaService.removeNoteFromMediaUpload(mediaUpload);"
+   ],
+   [
+    135,
+    "      }"
+   ],
+   [
+    136,
+    "    }"
+   ],
+   [
+    137,
+    "    this.logger.debug(`Deleting note: ${noteId}`, 'deleteNote');"
+   ],
+   [
+    138,
+    "    await this.noteService.deleteNote(noteId);"
+   ]
+  ],
+  "before_line": 134,
+  "before_mapped": true,
+  "after": [
+   [
+    130,
+    "    for (const mediaUpload of mediaUploads) {"
+   ],
+   [
+    131,
+    "      if (!noteMediaDeletionDto.keepMedia) {"
+   ],
+   [
+    132,
+    "        await this.mediaService.deleteFile(mediaUpload);"
+   ],
+   [
+    133,
+    "      } else {"
+   ],
+   [
+    134,
+    "        await this.mediaService.removeNoteFromMediaUpload(mediaUpload, noteId);"
+   ],
+   [
+    135,
+    "      }"
+   ],
+   [
+    136,
+    "    }"
+   ],
+   [
+    137,
+    "    this.logger.debug(`Deleting note: ${noteId}`, 'deleteNote');"
+   ],
+   [
+    138,
+    "    await this.noteService.deleteNote(noteId);"
+   ]
+  ],
+  "diff": "@@ -131,7 +131,7 @@ export class NotesController {\n       if (!noteMediaDeletionDto.keepMedia) {\n         await this.mediaService.deleteFile(mediaUpload);\n       } else {\n-        await this.mediaService.removeNoteFromMediaUpload(mediaUpload);\n+        await this.mediaService.removeNoteFromMediaUpload(mediaUpload, noteId);\n       }\n     }\n     this.logger.debug(`Deleting note: ${noteId}`, 'deleteNote');\n"
+ },
+ {
+  "item": "F089",
+  "kind": "pair",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/719e7c189df8cc023d756198938d60b280be9c61",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "arches/app/media/js/views/graph-designer.js",
+  "old_path": "arches/app/media/js/views/graph-designer.js",
+  "old_line": 775,
+  "line": 777,
+  "before": [
+   [
+    771,
+    "        };"
+   ],
+   [
+    772,
+    ""
+   ],
+   [
+    773,
+    "        var updateCardSelection = function() {"
+   ],
+   [
+    774,
+    "            var graphTreeSelection = viewModel.graphTree.selectedItems().length > 0 ? viewModel.graphTree.selectedItems()[0] : null;"
+   ],
+   [
+    775,
+    "            var matchingCard;"
+   ],
+   [
+    776,
+    "            if (graphTreeSelection) {"
+   ],
+   [
+    777,
+    "                if (graphTreeSelection.istopnode === true) {"
+   ],
+   [
+    778,
+    "                    viewModel.cardTree.selection(viewModel.cardTree.topCards()[0]);"
+   ],
+   [
+    779,
+    "                } else {"
+   ]
+  ],
+  "before_line": 775,
+  "before_mapped": true,
+  "after": [
+   [
+    773,
+    "        };"
+   ],
+   [
+    774,
+    ""
+   ],
+   [
+    775,
+    "        var updateCardSelection = function() {"
+   ],
+   [
+    776,
+    "            var graphTreeSelection = viewModel.graphTree.selectedItems().length > 0 ? viewModel.graphTree.selectedItems()[0] : null;"
+   ],
+   [
+    777,
+    "            var matchingCard;"
+   ],
+   [
+    778,
+    "            if (graphTreeSelection) {"
+   ],
+   [
+    779,
+    "                if (graphTreeSelection.istopnode === true) {"
+   ],
+   [
+    780,
+    "                    viewModel.cardTree.selection(viewModel.cardTree.topCards()[0]);"
+   ],
+   [
+    781,
+    "                } else {"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F090",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-QUAL-103",
+  "rule_title": "Function is too complex",
+  "path": "packages/features/bookings/lib/payment/handleNoShowFee.ts",
+  "old_path": "packages/features/bookings/lib/payment/handleNoShowFee.ts",
+  "old_line": 21,
+  "line": 19,
+  "before": [
+   [
+    17,
+    "import type { Prisma } from \"@calcom/prisma/client\";"
+   ],
+   [
+    18,
+    "import type { CalendarEvent } from \"@calcom/types/Calendar\";"
+   ],
+   [
+    19,
+    "import type { IAbstractPaymentService } from \"@calcom/types/PaymentService\";"
+   ],
+   [
+    20,
+    ""
+   ],
+   [
+    21,
+    "export const handleNoShowFee = async ({"
+   ],
+   [
+    22,
+    "  booking,"
+   ],
+   [
+    23,
+    "  payment,"
+   ],
+   [
+    24,
+    "}: {"
+   ],
+   [
+    25,
+    "  booking: {"
+   ]
+  ],
+  "before_line": 21,
+  "before_mapped": true,
+  "after": [
+   [
+    15,
+    "import type { Prisma } from \"@calcom/prisma/client\";"
+   ],
+   [
+    16,
+    "import type { CalendarEvent } from \"@calcom/types/Calendar\";"
+   ],
+   [
+    17,
+    "import type { IAbstractPaymentService } from \"@calcom/types/PaymentService\";"
+   ],
+   [
+    18,
+    ""
+   ],
+   [
+    19,
+    "export const handleNoShowFee= async ({"
+   ],
+   [
+    20,
+    "  booking,"
+   ],
+   [
+    21,
+    "  payment,"
+   ],
+   [
+    22,
+    "}: {"
+   ],
+   [
+    23,
+    "  booking: {"
+   ]
+  ],
+  "diff": "@@ -3,12 +3,10 @@ import { eventTypeMetaDataSchemaWithTypedApps } from \"@calcom/app-store/zod-util\n import dayjs from \"@calcom/dayjs\";\n import { sendNoShowFeeChargedEmail } from \"@calcom/emails/billing-email-service\";\n import { CredentialRepository } from \"@calcom/features/credentials/repositories/CredentialRepository\";\n-import { TeamRepository } from \"@calcom/features/ee/teams/repositories/TeamRepository\";\n import {\n   type EventTypeBrandingData,\n   getEventTypeService,\n } from \"@calcom/features/eventtypes/di/EventTypeService.container\";\n-import { MembershipRepository } from \"@calcom/features/membership/repositories/MembershipRepository\";\n import { ErrorCode } from \"@calcom/lib/errorCodes\";\n import { ErrorWithCode } from \"@calcom/lib/errors\";\n import logger from \"@calcom/lib/logger\";\n@@ -18,7 +16,7 @@ import type { Prisma } from \"@calcom/prisma/client\";\n import type { CalendarEvent } from \"@calcom/types/Calendar\";\n import type { IAbstractPaymentService } from \"@calcom/types/PaymentService\";\n\n-export const handleNoShowFee = async ({\n+export const handleNoShowFee= async ({\n   booking,\n   payment,\n }: {"
+ },
+ {
+  "item": "F091",
+  "kind": "pair",
+  "repository": "weblate",
+  "commit_url": "https://github.com/WeblateOrg/weblate/commit/f4e6cc3fe00e4ea1c0dd849af897442246f14191",
+  "rule": "CG-QUAL-004",
+  "rule_title": "Code is nested too deeply",
+  "path": "weblate/trans/tests/test_autotranslate.py",
+  "old_path": "weblate/trans/tests/test_autotranslate.py",
+  "old_line": 1621,
+  "line": 1639,
+  "before": [
+   [
+    1617,
+    "        translation = self.component3.translation_set.get(language_code=\"cs\")"
+   ],
+   [
+    1618,
+    "        translation.invalidate_cache()"
+   ],
+   [
+    1619,
+    "        self.assertEqual(translation.stats.translated, expected)"
+   ],
+   [
+    1620,
+    ""
+   ],
+   [
+    1621,
+    "    def test_component_help_matches_scope_and_accepted_inputs(self) -> None:"
+   ],
+   [
+    1622,
+    "        workspace = Workspace.objects.create(name=\"Automatic translation workspace\")"
+   ],
+   [
+    1623,
+    "        self.project.workspace = workspace"
+   ],
+   [
+    1624,
+    "        self.project.save(update_fields=[\"workspace\"])"
+   ],
+   [
+    1625,
+    "        original_values_list = ComponentQuerySet.values_list"
+   ]
+  ],
+  "before_line": 1621,
+  "before_mapped": true,
+  "after": [
+   [
+    1635,
+    "        translation = self.component3.translation_set.get(language_code=\"cs\")"
+   ],
+   [
+    1636,
+    "        translation.invalidate_cache()"
+   ],
+   [
+    1637,
+    "        self.assertEqual(translation.stats.translated, expected)"
+   ],
+   [
+    1638,
+    ""
+   ],
+   [
+    1639,
+    "    def test_component_help_matches_scope_and_accepted_inputs(self) -> None:"
+   ],
+   [
+    1640,
+    "        workspace = Workspace.objects.create(name=\"Automatic translation workspace\")"
+   ],
+   [
+    1641,
+    "        self.project.workspace = workspace"
+   ],
+   [
+    1642,
+    "        self.project.save(update_fields=[\"workspace\"])"
+   ],
+   [
+    1643,
+    "        original_values_list = ComponentQuerySet.values_list"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F092",
+  "kind": "introduced",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/1660adeb537a3524290c6885c6b9feca63cf675b",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "scripts/seed.ts",
+  "old_path": "scripts/seed.ts",
+  "old_line": null,
+  "line": 1008,
+  "before": [
+   [
+    1244,
+    "      email: \"teampro4@example.com\","
+   ],
+   [
+    1245,
+    "      password: \"teampro4\","
+   ],
+   [
+    1246,
+    "      username: \"teampro4\","
+   ],
+   [
+    1247,
+    "      name: \"Team Pro Example 4\","
+   ],
+   [
+    1248,
+    "    },"
+   ],
+   [
+    1249,
+    "  });"
+   ],
+   [
+    1250,
+    ""
+   ],
+   [
+    1251,
+    "  if (process.env.E2E_TEST_CALCOM_QA_EMAIL && process.env.E2E_TEST_CALCOM_QA_PASSWORD) {"
+   ],
+   [
+    1252,
+    "    await createUserAndEventType({"
+   ],
+   [
+    1253,
+    "      user: {"
+   ],
+   [
+    1254,
+    "        email: process.env.E2E_TEST_CALCOM_QA_EMAIL || \"qa@example.com\","
+   ],
+   [
+    1255,
+    "        password: process.env.E2E_TEST_CALCOM_QA_PASSWORD || \"qa\","
+   ],
+   [
+    1256,
+    "        username: \"qa\","
+   ]
+  ],
+  "before_line": 1250,
+  "before_mapped": false,
+  "after": [
+   [
+    1004,
+    "  const admin = await createUserAndEventType({"
+   ],
+   [
+    1005,
+    "    user: {"
+   ],
+   [
+    1006,
+    "      email: \"admin@example.com\","
+   ],
+   [
+    1007,
+    "      /** To comply with admin password requirements  */"
+   ],
+   [
+    1008,
+    "      password: \"ADMINadmin2022!\","
+   ],
+   [
+    1009,
+    "      username: \"admin\","
+   ],
+   [
+    1010,
+    "      name: \"Admin Example\","
+   ],
+   [
+    1011,
+    "      role: \"ADMIN\","
+   ],
+   [
+    1012,
+    "    },"
+   ]
+  ],
+  "diff": "@@ -1248,6 +1001,32 @@ async function main() {\n     },\n   });\n\n+  const admin = await createUserAndEventType({\n+    user: {\n+      email: \"admin@example.com\",\n+      /** To comply with admin password requirements  */\n+      password: \"ADMINadmin2022!\",\n+      username: \"admin\",\n+      name: \"Admin Example\",\n+      role: \"ADMIN\",\n+    },\n+  });\n+\n+  const clientId = process.env.SEED_OAUTH2_CLIENT_ID;\n+  const clientSecret = process.env.SEED_OAUTH2_CLIENT_SECRET_HASHED;\n+\n+  if (clientId && clientSecret) {\n+    await createOAuthClientForUser(admin.id, {\n+      clientId,\n+      clientSecret,\n+      name: \"atoms examples app oauth 2 client\",\n+      purpose: \"test atoms examples app with oauth 2\",\n+      redirectUri: \"http://localhost:4321\",\n+      websiteUrl: \"http://localhost:4321\",\n+      enablePkce: false,\n+    });\n+  }\n+\n   if (process.env.E2E_TEST_CALCOM_QA_EMAIL && process.env.E2E_TEST_CALCOM_QA_PASSWORD) {\n     await createUserAndEventType({\n       user: {\n"
+ },
+ {
+  "item": "F093",
+  "kind": "introduced",
+  "repository": "intelowl",
+  "commit_url": "https://github.com/intelowlproject/IntelOwl/commit/80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "frontend/tests/components/auth/utils/validator.test.jsx",
+  "old_path": "frontend/tests/components/auth/utils/validator.test.jsx",
+  "old_line": null,
+  "line": 45,
+  "before": [
+   [
+    39,
+    "      password: \"Must be 12 characters or more\","
+   ],
+   [
+    40,
+    "    });"
+   ],
+   [
+    41,
+    "  });"
+   ],
+   [
+    42,
+    "  test(\"Invalid password\", () => {"
+   ],
+   [
+    43,
+    "    const numericPassword = \"123456123456\";"
+   ],
+   [
+    44,
+    "    expect(PasswordValidator(numericPassword)).toEqual({"
+   ],
+   [
+    45,
+    "      password:"
+   ],
+   [
+    46,
+    "        \"The password is entirely numeric or contains special characters\","
+   ],
+   [
+    47,
+    "    });"
+   ],
+   [
+    48,
+    "    const password = \"intelowlpassword$\";"
+   ],
+   [
+    49,
+    "    expect(PasswordValidator(password)).toEqual({"
+   ],
+   [
+    50,
+    "      password:"
+   ],
+   [
+    51,
+    "        \"The password is entirely numeric or contains special characters\","
+   ]
+  ],
+  "before_line": 45,
+  "before_mapped": false,
+  "after": [
+   [
+    41,
+    "  });"
+   ],
+   [
+    42,
+    "  test(\"Invalid password\", () => {"
+   ],
+   [
+    43,
+    "    const numericPassword = \"123456123456\";"
+   ],
+   [
+    44,
+    "    expect(PasswordValidator(numericPassword)).toEqual({"
+   ],
+   [
+    45,
+    "      password: \"The password cannot be entirely numeric\","
+   ],
+   [
+    46,
+    "    });"
+   ],
+   [
+    47,
+    "  });"
+   ],
+   [
+    48,
+    "  test(\"Password with special characters is valid\", () => {"
+   ],
+   [
+    49,
+    "    const password = \"intelowlpassword$\";"
+   ]
+  ],
+  "diff": "@@ -42,14 +42,12 @@ describe(\"Password\", () => {\n   test(\"Invalid password\", () => {\n     const numericPassword = \"123456123456\";\n     expect(PasswordValidator(numericPassword)).toEqual({\n-      password:\n-        \"The password is entirely numeric or contains special characters\",\n+      password: \"The password cannot be entirely numeric\",\n     });\n+  });\n+  test(\"Password with special characters is valid\", () => {\n     const password = \"intelowlpassword$\";\n-    expect(PasswordValidator(password)).toEqual({\n-      password:\n-        \"The password is entirely numeric or contains special characters\",\n-    });\n+    expect(PasswordValidator(password)).toEqual({});\n   });\n });\n\n"
+ },
+ {
+  "item": "F094",
+  "kind": "introduced",
+  "repository": "lnbits",
+  "commit_url": "https://github.com/lnbits/lnbits/commit/61ed636df066ced4c600a5eb55af147e6d13d130",
+  "rule": "CG-QUAL-005",
+  "rule_title": "Function takes too many parameters",
+  "path": "lnbits/core/services/extensions.py",
+  "old_path": "lnbits/core/services/extensions.py",
+  "old_line": null,
+  "line": 268,
+  "before": [
+   [
+    70,
+    "    if settings.lnbits_max_extensions == 0 or installed_ext:"
+   ],
+   [
+    71,
+    "        return"
+   ],
+   [
+    72,
+    ""
+   ],
+   [
+    73,
+    "    extensions_count = await get_installed_extensions_count()"
+   ],
+   [
+    74,
+    "    if extensions_count >= settings.lnbits_max_extensions:"
+   ],
+   [
+    75,
+    "        raise ValueError(\"Max amount of extensions have been installed\")"
+   ],
+   [
+    76,
+    ""
+   ],
+   [
+    77,
+    ""
+   ],
+   [
+    78,
+    "async def uninstall_extension(ext_id: str):"
+   ],
+   [
+    79,
+    "    await stop_extension_background_work(ext_id)"
+   ],
+   [
+    80,
+    ""
+   ],
+   [
+    81,
+    "    settings.deactivate_extension_paths(ext_id)"
+   ],
+   [
+    82,
+    ""
+   ]
+  ],
+  "before_line": 76,
+  "before_mapped": false,
+  "after": [
+   [
+    264,
+    "                settings.lnbits_wasm_invocation_retention_days"
+   ],
+   [
+    265,
+    "            )"
+   ],
+   [
+    266,
+    ""
+   ],
+   [
+    267,
+    ""
+   ],
+   [
+    268,
+    "async def start_wasm_invocation("
+   ],
+   [
+    269,
+    "    *,"
+   ],
+   [
+    270,
+    "    extension_id: str,"
+   ],
+   [
+    271,
+    "    export_name: str,"
+   ],
+   [
+    272,
+    "    trigger_type: str = \"unknown\","
+   ]
+  ],
+  "diff": "@@ -75,6 +245,394 @@ async def check_extensions_limit(installed_ext: InstallableExtension | None = No\n         raise ValueError(\"Max amount of extensions have been installed\")\n\n\n+async def ensure_wasm_invocation_monitoring_ready() -> None:\n+    global _wasm_invocations_last_cleanup_at, _wasm_invocations_marked_stale\n+\n+    async with _wasm_invocation_ready_lock:\n+        now = _now()\n+        if not _wasm_invocations_marked_stale:\n+            await mark_stale_wasm_invocations()\n+            _wasm_invocations_marked_stale = True\n+\n+        if (\n+            _wasm_invocations_last_cleanup_at is None\n+            or now - _wasm_invocations_last_cleanup_at\n+            >= _WASM_INVOCATION_CLEANUP_INTERVAL\n+        ):\n+            _wasm_invocations_last_cleanup_at = now\n+            await delete_old_wasm_invocations(\n+                settings.lnbits_wasm_invocation_retention_days\n+            )\n+\n+\n+async def start_wasm_invocation(\n+    *,\n+    extension_id: str,\n+    export_name: str,\n+    trigger_type: str = \"unknown\",\n+    user_id: str | None = None,\n+    wallet_id: str | None = None,\n+    request_id: str | None = None,\n+    method: str | None = None,\n+    path: str | None = None,\n+    event_type: str | None = None,\n+    payment_hash: str | None = None,\n+    checking_id: str | None = None,\n+    request_bytes: int | None = None,\n+    context: dict | None = None,\n+    runtime_limits: dict[str, int] | None = None,\n... (355 more lines)"
+ },
+ {
+  "item": "F095",
+  "kind": "introduced",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "arches/app/media/js/views/graph/permission-manager/permission-settings-form.js",
+  "old_path": "arches/app/media/js/views/graph/permission-manager/permission-settings-form.js",
+  "old_line": null,
+  "line": 30,
+  "before": [
+   [
+    16,
+    "    /**"
+   ],
+   [
+    17,
+    "    * Initializes the view with optional parameters"
+   ],
+   [
+    18,
+    "    * @memberof PermissionSettingsForm.prototype"
+   ],
+   [
+    19,
+    "    * @param {boolean} options.selection - the selected item, either a {@link CardModel} or a {@link NodeModel}"
+   ],
+   [
+    20,
+    "    */"
+   ],
+   [
+    21,
+    "    initialize: function(options) {"
+   ],
+   [
+    22,
+    "        this.selectedIdentities = options.selectedIdentities;"
+   ],
+   [
+    23,
+    "        this.identityList = options.identityList;"
+   ],
+   [
+    24,
+    "        this.selectedCards = options.selectedCards;"
+   ],
+   [
+    25,
+    "        this.noAccessPerm = undefined;"
+   ],
+   [
+    26,
+    "        this.whiteListPerms = [];"
+   ],
+   [
+    27,
+    "        this.groupedNodeList = options.groupedNodeList;"
+   ],
+   [
+    28,
+    ""
+   ]
+  ],
+  "before_line": 22,
+  "before_mapped": false,
+  "after": [
+   [
+    26,
+    "    * @memberof PermissionSettingsForm.prototype"
+   ],
+   [
+    27,
+    "    * @param {boolean} options.selection - the selected item, either a {@link CardModel} or a {@link NodeModel}"
+   ],
+   [
+    28,
+    "    */"
+   ],
+   [
+    29,
+    "    initialize: function(options) {"
+   ],
+   [
+    30,
+    "        var self = this;"
+   ],
+   [
+    31,
+    "        this.selectedIdentities = options.selectedIdentities;"
+   ],
+   [
+    32,
+    "        this.identityList = options.identityList;"
+   ],
+   [
+    33,
+    "        this.selectedCards = options.selectedCards;"
+   ],
+   [
+    34,
+    "        this.permissionsByNodegroup = options.permissionsByNodegroup || ko.observable({});"
+   ]
+  ],
+  "diff": "@@ -19,9 +27,13 @@ var PermissionSettingsForm = Backbone.View.extend({\n     * @param {boolean} options.selection - the selected item, either a {@link CardModel} or a {@link NodeModel}\n     */\n     initialize: function(options) {\n+        var self = this;\n         this.selectedIdentities = options.selectedIdentities;\n         this.identityList = options.identityList;\n         this.selectedCards = options.selectedCards;\n+        this.permissionsByNodegroup = options.permissionsByNodegroup || ko.observable({});\n+        this.loading = options.loading || ko.observable(false);\n+        this.alert = options.alert || ko.observable();\n         this.noAccessPerm = undefined;\n         this.whiteListPerms = [];\n         this.groupedNodeList = options.groupedNodeList;"
+ },
+ {
+  "item": "F096",
+  "kind": "introduced",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/089a39f59f39f4cd613ab0064dc23117b080c538",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/update-booking-location.e2e-spec.ts",
+  "old_path": "apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/update-booking-location.e2e-spec.ts",
+  "old_line": null,
+  "line": 529,
+  "before": [
+   [
+    319,
+    "        }"
+   ],
+   [
+    320,
+    "        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;"
+   ],
+   [
+    321,
+    "        expect(updatedBooking).toHaveProperty(\"id\");"
+   ],
+   [
+    322,
+    "        expect(updatedBooking.location).toEqual(attendeeDefinedLocation);"
+   ],
+   [
+    323,
+    "      });"
+   ],
+   [
+    324,
+    ""
+   ],
+   [
+    325,
+    "      afterAll(async () => {"
+   ],
+   [
+    326,
+    "        if (responseDataIsBooking(booking)) {"
+   ],
+   [
+    327,
+    "          await bookingsRepositoryFixture.deleteById(bookingId);"
+   ],
+   [
+    328,
+    "        } else {"
+   ],
+   [
+    329,
+    "          throw new Error(\"Unexpected response data type\");"
+   ],
+   [
+    330,
+    "        }"
+   ],
+   [
+    331,
+    "      });"
+   ]
+  ],
+  "before_line": 325,
+  "before_mapped": false,
+  "after": [
+   [
+    525,
+    ""
+   ],
+   [
+    526,
+    "      it(\"can update location to type integration (office365-video)\", async () => {"
+   ],
+   [
+    527,
+    "        const office365Credential = await credentialsRepositoryFixture.create("
+   ],
+   [
+    528,
+    "          \"office365_calendar\","
+   ],
+   [
+    529,
+    "          { access_token: \"mock\", refresh_token: \"mock\", expiry_date: Date.now() + 3600000 },"
+   ],
+   [
+    530,
+    "          testSetup.organizer.id,"
+   ],
+   [
+    531,
+    "          \"office365-calendar\""
+   ],
+   [
+    532,
+    "        );"
+   ],
+   [
+    533,
+    ""
+   ]
+  ],
+  "diff": "@@ -322,6 +387,219 @@ describe(\"Bookings Endpoints 2024-08-13 update booking location\", () => {\n         expect(updatedBooking.location).toEqual(attendeeDefinedLocation);\n       });\n\n+      it(\"can update location to type integration (cal-video)\", async () => {\n+        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {\n+          location: {\n+            type: \"integration\",\n+            integration: \"cal-video\",\n+          },\n+        };\n+\n+        const updatedBookingResponse = await request(app.getHttpServer())\n+          .patch(`/v2/bookings/${bookingUid}/location`)\n+          .send(updatedBookingBody)\n+          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)\n+          .set(\"Authorization\", `Bearer ${testSetup.organizer.accessToken}`)\n+          .expect(200);\n+\n+        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =\n+          updatedBookingResponse.body;\n+        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);\n+        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {\n+          throw new Error(\n+            \"Invalid response data - expected booking but received array of possibly recurring bookings\"\n+          );\n+        }\n+        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;\n+        expect(updatedBooking).toHaveProperty(\"id\");\n+        // cal-video location should be either a Daily video URL or the internal location string\n+        expect(\n+          updatedBooking.location?.startsWith(\"http\") || updatedBooking.location === \"integrations:daily\"\n+        ).toBe(true);\n+      });\n+\n+      it(\"can update location to type integration (google-meet)\", async () => {\n+        const googleCredential = await credentialsRepositoryFixture.create(\n+          \"google_calendar\",\n+          { access_token: \"mock\", refresh_token: \"mock\", expiry_date: Date.now() + 3600000 },\n+          testSetup.organizer.id,\n... (181 more lines)"
+ },
+ {
+  "item": "F097",
+  "kind": "pair",
+  "repository": "calcom",
+  "commit_url": "https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c",
+  "rule": "CG-SEC-105",
+  "rule_title": "Hardcoded secret",
+  "path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_path": "packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts",
+  "old_line": 2486,
+  "line": 3172,
+  "before": [
+   [
+    2482,
+    "                  {"
+   ],
+   [
+    2483,
+    "                    type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    2484,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    2485,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    2486,
+    "                    meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    2487,
+    "                    meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    2488,
+    "                    credentialId: null,"
+   ],
+   [
+    2489,
+    "                  },"
+   ],
+   [
+    2490,
+    "                  {"
+   ]
+  ],
+  "before_line": 2486,
+  "before_mapped": true,
+  "after": [
+   [
+    3168,
+    "                  {"
+   ],
+   [
+    3169,
+    "                    type: appStoreMetadata.dailyvideo.type,"
+   ],
+   [
+    3170,
+    "                    uid: \"MOCK_ID\","
+   ],
+   [
+    3171,
+    "                    meetingId: \"MOCK_ID\","
+   ],
+   [
+    3172,
+    "                    meetingPassword: \"MOCK_PASS\","
+   ],
+   [
+    3173,
+    "                    meetingUrl: \"http://mock-dailyvideo.example.com\","
+   ],
+   [
+    3174,
+    "                    credentialId: null,"
+   ],
+   [
+    3175,
+    "                  },"
+   ],
+   [
+    3176,
+    "                  {"
+   ]
+  ],
+  "diff": "(no diff hunk near this line)"
+ },
+ {
+  "item": "F098",
+  "kind": "introduced",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "arches/app/media/js/views/graph/permission-designer.js",
+  "old_path": "arches/app/media/js/views/graph/permission-designer.js",
+  "old_line": null,
+  "line": 157,
+  "before": [
+   [
+    113,
+    "                            }"
+   ],
+   [
+    114,
+    "                        });"
+   ],
+   [
+    115,
+    "                    }"
+   ],
+   [
+    116,
+    "                });"
+   ],
+   [
+    117,
+    "            }"
+   ],
+   [
+    118,
+    "        };"
+   ],
+   [
+    119,
+    "    };"
+   ],
+   [
+    120,
+    ""
+   ],
+   [
+    121,
+    "    export default PermissionDesignerViewModel;"
+   ],
+   [
+    122,
+    "    /**"
+   ],
+   [
+    123,
+    "    * a GraphPageView representing the graph manager page"
+   ],
+   [
+    124,
+    "    */"
+   ],
+   [
+    125,
+    "    // var graphPageView = new GraphPageView({"
+   ]
+  ],
+  "before_line": 119,
+  "before_mapped": false,
+  "after": [
+   [
+    153,
+    "                        }"
+   ],
+   [
+    154,
+    ""
+   ],
+   [
+    155,
+    "                        var inherited = nodegroup.explicit.length === 0;"
+   ],
+   [
+    156,
+    "                        var sourceLabel = describeSource(nodegroup.source);"
+   ],
+   [
+    157,
+    "                        var perms = nodegroup.effective.map(function(perm) {"
+   ],
+   [
+    158,
+    "                            return {"
+   ],
+   [
+    159,
+    "                                codename: perm.codename,"
+   ],
+   [
+    160,
+    "                                name: perm.name,"
+   ],
+   [
+    161,
+    "                                icon: permIcons[perm.codename],"
+   ]
+  ],
+  "diff": "@@ -70,62 +99,82 @@ import PermissionSettingsForm from 'views/graph/permission-manager/permission-se\n                         self.updatePermissions();\n                     });\n                 })\n-                .fail(function(err) {\n-                    console.log(err);\n+                .fail(function(response) {\n+                    showError(response.responseJSON, arches.translations.graphDesignerPermissionsLoadError);\n+                })\n+                .always(function() {\n+                    self.loading(false);\n                 });\n         };\n\n+        var setCardPerms = function(card, perms, literal) {\n+            card.perms(perms);\n+            card.permsLiteral(literal);\n+            if (card.type === 'card' && card.children && card.children.length > 0) {\n+                card.children.forEach(function(child) {\n+                    if (child.type === 'node' && child.perms) {\n+                        child.perms(perms);\n+                    }\n+                });\n+            }\n+        };\n+\n         this.updatePermissions = function() {\n-            var item = self.identityList.selectedItems()[0];\n-            var nodegroupIds = [];\n+            var identity = self.identityList.selectedItems()[0];\n\n-            if (item) {\n-                self.cardList.forEach(function(item) {\n-                    nodegroupIds.push(item.model.nodegroup_id());\n+            if (!identity || !self.cardList) {\n+                self.permissionsByNodegroup({});\n+                (self.cardList || []).forEach(function(card) {\n+                    setCardPerms(card, [], '');\n                 });\n-                $.ajax({\n... (91 more lines)"
+ },
+ {
+  "item": "F099",
+  "kind": "introduced",
+  "repository": "arches",
+  "commit_url": "https://github.com/archesproject/arches/commit/ac6a5ab6907f92256a1ebdbc373de7cabb41e3b0",
+  "rule": "CG-QUAL-104",
+  "rule_title": "var declaration",
+  "path": "arches/app/media/js/views/graph-designer.js",
+  "old_path": "arches/app/media/js/views/graph-designer.js",
+  "old_line": null,
+  "line": 793,
+  "before": [
+   [
+    786,
+    "                        viewModel.cardTree.expandToRoot(viewModel.cardTree.selection());"
+   ],
+   [
+    787,
+    "                    }"
+   ],
+   [
+    788,
+    "                }"
+   ],
+   [
+    789,
+    "            }"
+   ],
+   [
+    790,
+    "        };"
+   ],
+   [
+    791,
+    ""
+   ],
+   [
+    792,
+    "        var updatePermissionCardSelection = function() {"
+   ],
+   [
+    793,
+    "            var matchingCard = correspondingCard(viewModel.cardTree.selection(), viewModel.permissionTree);"
+   ],
+   [
+    794,
+    "            if (matchingCard) {"
+   ],
+   [
+    795,
+    "                viewModel.permissionTree.expandToRoot(matchingCard);"
+   ],
+   [
+    796,
+    "                viewModel.permissionTree.selection.removeAll();"
+   ],
+   [
+    797,
+    "                matchingCard.selectChildCards();"
+   ],
+   [
+    798,
+    "            }"
+   ]
+  ],
+  "before_line": 792,
+  "before_mapped": false,
+  "after": [
+   [
+    789,
+    "            }"
+   ],
+   [
+    790,
+    "        };"
+   ],
+   [
+    791,
+    ""
+   ],
+   [
+    792,
+    "        // only follow the Cards tab when its selection changed, so a multi-selection survives tab switches"
+   ],
+   [
+    793,
+    "        var lastSyncedCardSelection;"
+   ],
+   [
+    794,
+    "        var updatePermissionCardSelection = function() {"
+   ],
+   [
+    795,
+    "            var cardSelection = viewModel.cardTree.selection();"
+   ],
+   [
+    796,
+    "            if (cardSelection === lastSyncedCardSelection) {"
+   ],
+   [
+    797,
+    "                return;"
+   ]
+  ],
+  "diff": "@@ -789,12 +789,19 @@ var GraphDesignerView = BaseManagerView.extend({\n             }\n         };\n\n+        // only follow the Cards tab when its selection changed, so a multi-selection survives tab switches\n+        var lastSyncedCardSelection;\n         var updatePermissionCardSelection = function() {\n-            var matchingCard = correspondingCard(viewModel.cardTree.selection(), viewModel.permissionTree);\n+            var cardSelection = viewModel.cardTree.selection();\n+            if (cardSelection === lastSyncedCardSelection) {\n+                return;\n+            }\n+            lastSyncedCardSelection = cardSelection;\n+            var matchingCard = correspondingCard(cardSelection, viewModel.permissionTree);\n             if (matchingCard) {\n                 viewModel.permissionTree.expandToRoot(matchingCard);\n                 viewModel.permissionTree.selection.removeAll();\n-                matchingCard.selectChildCards();\n+                matchingCard.selectChildCards(true);\n             }\n         };\n\n"
+ },
+ {
+  "item": "F100",
+  "kind": "pair",
+  "repository": "indico",
+  "commit_url": "https://github.com/indico/indico/commit/4c706171e684907abb2a5a032d81be1c10f919b0",
+  "rule": "CG-QUAL-003",
+  "rule_title": "Function is too complex",
+  "path": "indico/modules/events/registration/util.py",
+  "old_path": "indico/modules/events/registration/util.py",
+  "old_line": 596,
+  "line": 596,
+  "before": [
+   [
+    592,
+    "        for item in regform_items if item.input_type == 'date'"
+   ],
+   [
+    593,
+    "    }"
+   ],
+   [
+    594,
+    ""
+   ],
+   [
+    595,
+    ""
+   ],
+   [
+    596,
+    "def generate_spreadsheet_from_registrations(registrations, regform_items, static_items):"
+   ],
+   [
+    597,
+    "    \"\"\"Generate a spreadsheet data from a given registration list."
+   ],
+   [
+    598,
+    ""
+   ],
+   [
+    599,
+    "    :param registrations: The list of registrations to include in the file"
+   ],
+   [
+    600,
+    "    :param regform_items: The registration form items to be used as columns"
+   ]
+  ],
+  "before_line": 596,
+  "before_mapped": true,
+  "after": [
+   [
+    592,
+    "        for item in regform_items if item.input_type == 'date'"
+   ],
+   [
+    593,
+    "    }"
+   ],
+   [
+    594,
+    ""
+   ],
+   [
+    595,
+    ""
+   ],
+   [
+    596,
+    "def generate_spreadsheet_from_registrations(registrations, regform_items, static_items, extra_columns=()):"
+   ],
+   [
+    597,
+    "    \"\"\"Generate a spreadsheet data from a given registration list."
+   ],
+   [
+    598,
+    ""
+   ],
+   [
+    599,
+    "    :param registrations: The list of registrations to include in the file"
+   ],
+   [
+    600,
+    "    :param regform_items: The registration form items to be used as columns"
+   ]
+  ],
+  "diff": "@@ -593,12 +593,13 @@ def get_registration_spreadsheet_column_formats(regform_items):\n     }\n\n\n-def generate_spreadsheet_from_registrations(registrations, regform_items, static_items):\n+def generate_spreadsheet_from_registrations(registrations, regform_items, static_items, extra_columns=()):\n     \"\"\"Generate a spreadsheet data from a given registration list.\n\n     :param registrations: The list of registrations to include in the file\n     :param regform_items: The registration form items to be used as columns\n     :param static_items: Registration form information as extra columns\n+    :param extra_columns: Custom list items from the `registrant_list_items` signal\n     \"\"\"\n     field_names = ['ID', 'Name']\n     special_item_mapping = {"
+ }
+]
diff --git a/research/finding_identity/paper/ground_truth_check/sample.csv b/research/finding_identity/paper/ground_truth_check/sample.csv
index 535dbaa..bfdc977 100644
--- a/research/finding_identity/paper/ground_truth_check/sample.csv
+++ b/research/finding_identity/paper/ground_truth_check/sample.csv
@@ -1,101 +1,101 @@
-id,stratum,repository,commit,path,rule,truth,old_line,line,disagreeing_schemes,verdict,note
-1,edited,arches,403c4626495b979fe831a8f0baf6d8577708e3d7,arches/app/media/js/views/resource/edit-log.js,CG-QUAL-101,known (edited),58,61,codeguard github line_text sonar,,
-2,edited,healthchecks,b83e3791d6e2c276a13c0b40c2e435c6ec01125c,static/js/checks.js,CG-QUAL-104,known (edited),13,13,codeguard github line_text,,
-3,edited,documenso,9c27ce6d185f7e25eec80439b931c4709723a2ae,packages/app-tests/e2e/teams/team-documents.spec.ts,CG-PERF-101,known (edited),37,29,codeguard github line_text sonar,,
-4,edited,pgadmin,5f56805162c117ac1de17368ef8fdc0b07221e2c,web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx,CG-QUAL-101,known (edited),713,749,codeguard github line_text sonar,,
-5,edited,openlibrary,53015559ebcd126850e7b07792ebc7bcfa847919,openlibrary/plugins/openlibrary/js/jsdef.js,CG-QUAL-104,known (edited),77,80,github line_text,,
-6,edited,hoppscotch,863b1b29a803f6c456b04dd82d19a53c7afc9102,packages/hoppscotch-common/src/lib/sync/settings/index.ts,CG-QUAL-101,known (edited),49,42,codeguard github line_text sonar,,
-7,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/buy/purchase.js,CG-QUAL-103,known (edited),79,79,codeguard github line_text sonar,,
-8,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/feed.js,CG-QUAL-103,known (edited),39,37,codeguard github line_text sonar,,
-9,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/buy/hourglassPurchase.js,CG-QUAL-103,known (edited),16,15,codeguard github line_text sonar,,
-10,edited,hedgedoc,2eeb2c72c680f2ce27b22a2d2e43fc86771a02f5,frontend/src/components/render-page/hooks/use-on-html-export-request.ts,CG-SEC-103,known (edited),32,41,codeguard github line_text sonar,,
-11,edited,ghost,0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3,tools/scripts/check-internal-packages.ts,CG-PERF-101,known (edited),285,339,codeguard github line_text sonar,,
-12,edited,kiwi,362febe93063899b8c7468cf7490c26028368a5c,tcms/testplans/static/testplans/js/clone.js,CG-SEC-109,known (edited),110,112,github line_text,,
-13,edited,hoppscotch,9861ee84ad593372885ebfc7cb1c487f3b9dd290,packages/hoppscotch-desktop/src/services/persistence.service.ts,CG-PERF-101,known (edited),112,294,codeguard github line_text sonar,,
-14,edited,uptime-kuma,4e7c4ae382f4038369922a7981babba43403ff1c,test/backend-test/test-migration-v2-to-v3.ts,CG-SEC-105,known (edited),17,21,github line_text sonar,,
-15,edited,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/payment/handleNoShowFee.ts,CG-QUAL-103,known (edited),21,19,line_text,,
-16,edited,hedgedoc,c2ccf48c3966608f7292c6818d1b95469aa1b3cd,backend/src/api/public/notes/notes.controller.ts,CG-PERF-101,known (edited),134,134,codeguard github line_text,,
-17,edited,warehouse,7320d9052b59a7e3b1c2122034396f5d339cd3e0,tests/frontend/filter_list_controller_test.js,CG-SEC-103,known (edited),39,101,codeguard github line_text sonar,,
-18,edited,pgadmin,5f56805162c117ac1de17368ef8fdc0b07221e2c,web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx,CG-QUAL-101,known (edited),813,872,codeguard github line_text sonar,,
-19,edited,indico,4c706171e684907abb2a5a032d81be1c10f919b0,indico/modules/events/registration/util.py,CG-QUAL-003,known (edited),596,596,codeguard github line_text sonar,,
-20,edited,edx-platform,b3f862e61aa84a5f8c027081b7d1a07a8619917d,cms/djangoapps/contentstore/api/views/course_import.py,CG-SEC-013,known (edited),142,145,line_text,,
-21,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1370,1704,codeguard github line_text,,
-22,known_but_new,documenso,97835b8dbb2ca24670c8a410972d949c982c8f61,packages/app-tests/e2e/envelope-editor-v2/envelope-fields.spec.ts,CG-SEC-105,known (equal),1000,1149,codeguard,,
-23,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2486,3172,codeguard line_text,,
-24,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1260,1594,codeguard github,,
-25,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),48,136,codeguard,,
-26,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1395,1728,codeguard line_text,,
-27,known_but_new,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),965,969,codeguard,,
-28,known_but_new,erpnext,750bf9d9b378fb92eab68733ae727214f3961c0a,erpnext/stock/utils.py,CG-PERF-002,known (equal),159,185,codeguard,,
-29,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),52,140,codeguard,,
-30,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2622,3308,codeguard line_text,,
-31,known_but_new,nodebb,9d122948cf783fc72c8c01c7aab0f42b2561b3c3,test/user.js,CG-SEC-105,known (equal),2384,2415,codeguard,,
-32,known_but_new,lnbits,f5989201d9c21a4690334f91bbbb421214c989e7,lnbits/static/js/wasm-extension-component.js,CG-QUAL-102,known (equal),904,1126,codeguard,,
-33,known_but_new,erpnext,ddc764b3608610fa659dd722da44e115850cc4da,erpnext/stock/doctype/material_request/material_request.js,CG-QUAL-101,known (equal),810,809,codeguard,,
-34,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2494,3180,codeguard github line_text,,
-35,known_but_new,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-manager/permission-settings-form.js,CG-QUAL-104,known (equal),128,210,codeguard github line_text,,
-36,known_but_new,nodebb,9d122948cf783fc72c8c01c7aab0f42b2561b3c3,test/user.js,CG-SEC-105,known (equal),1999,2030,codeguard line_text sonar,,
-37,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1267,1601,codeguard,,
-38,known_but_new,nodebb,b8d9cf9d1ee03115d28b3548911e9076a275311a,test/user.js,CG-SEC-105,known (equal),2318,2335,codeguard,,
-39,known_but_new,nodebb,331599fe89bed8c8ae80199efafeee9e81f72dbf,test/topics/crossposts.js,CG-SEC-105,known (equal),660,678,codeguard github line_text,,
-40,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),56,144,codeguard,,
-41,new_but_matched,hoppscotch,803e4633a27be10d80e752d62bd0dab09ed2924a,packages/hoppscotch-backend/src/team-collection/team-collection.service.ts,CG-PERF-101,new,,131,codeguard github line_text sonar,,
-42,new_but_matched,ckan,7a60264189f543fba04043d2193b09f545a6ef32,ckan/public-midnight-blue/base/javascript/modules/data-viewer.js,CG-QUAL-104,new,,27,sonar,,
-43,new_but_matched,pgadmin,a4bdcff7dc65e1b667b981574a7c7263bc84afd2,web/pgadmin/misc/cloud/static/js/cloud_components.jsx,CG-QUAL-101,new,,58,codeguard,,
-44,new_but_matched,intelowl,80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0,frontend/src/components/auth/utils/validator.jsx,CG-SEC-105,new,,24,sonar,,
-45,new_but_matched,intelowl,80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0,frontend/tests/components/auth/utils/validator.test.jsx,CG-SEC-105,new,,45,sonar,,
-46,new_but_matched,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-designer.js,CG-QUAL-104,new,,148,codeguard github sonar,,
-47,new_but_matched,geonode,6f00ca5b66b2459cf3a6556434d476810cabe0d4,geonode/geoserver/gwc.py,CG-SEC-002,new,,50,line_text,,
-48,new_but_matched,hoppscotch,342d0cbdf0c5435b715dc9f1917b851e413e08e3,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,new,,384,codeguard line_text,,
-49,new_but_matched,ghost,0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3,tools/scripts/test/public-apps.test.ts,CG-PERF-101,new,,67,sonar,,
-50,new_but_matched,immich,e66f2c7615bacbe6a9b156e300fc182e4d1a4fa3,server/src/services/person.service.ts,CG-PERF-101,new,,162,codeguard github sonar,,
-51,new_but_matched,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-manager/permission-settings-form.js,CG-QUAL-104,new,,30,codeguard line_text,,
-52,new_but_matched,readthedocs,857138d4d9659a62ce46f52a358f535b6ffeef75,readthedocs/rtd_tests/tests/test_api.py,CG-SEC-002,new,,331,github line_text,,
-53,new_but_matched,openlibrary,53015559ebcd126850e7b07792ebc7bcfa847919,openlibrary/plugins/openlibrary/js/graphs/plot.js,CG-QUAL-104,new,,20,sonar,,
-54,new_but_matched,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,new,,806,codeguard github line_text,,
-55,new_but_matched,ckan,7a60264189f543fba04043d2193b09f545a6ef32,ckan/public/base/javascript/modules/data-viewer.js,CG-QUAL-104,new,,27,sonar,,
-56,new_but_matched,calcom,1660adeb537a3524290c6885c6b9feca63cf675b,scripts/seed.ts,CG-SEC-105,new,,1008,codeguard github line_text sonar,,
-57,new_but_matched,hoppscotch,863b1b29a803f6c456b04dd82d19a53c7afc9102,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,new,,511,sonar,,
-58,new_but_matched,ghost,7da91e095b2803c62bc67fe70f2c4f0d114846d9,tools/scripts/test/ci-path-filters.test.js,CG-PERF-101,new,,69,codeguard line_text,,
-59,new_but_matched,arches,ac6a5ab6907f92256a1ebdbc373de7cabb41e3b0,arches/app/media/js/views/graph-designer.js,CG-QUAL-104,new,,793,sonar,,
-60,new_but_matched,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,new,,844,codeguard,,
-61,agree_known,ckan,fd309bc144f08505087d8b8d463aa8da296ba766,ckan/public/base/javascript/client.js,CG-QUAL-104,known (equal),227,226,,,
-62,agree_known,hoppscotch,1855faabbc4ff968d874f54510f6c586a7fdae05,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,known (equal),796,799,,,
-63,agree_known,indico,1ab29e13596cacf234ce75f7c0d4be217010ba6d,indico/modules/events/registration/util.py,CG-QUAL-003,known (equal),474,474,,,
-64,agree_known,securedrop,871378be59567ac2916c1ae5d8f347784288d46f,securedrop/tests/test_journalist_api2.py,CG-QUAL-003,known (equal),738,738,,,
-65,agree_known,weblate,f4e6cc3fe00e4ea1c0dd849af897442246f14191,weblate/trans/tests/test_autotranslate.py,CG-QUAL-004,known (equal),1621,1639,,,
-66,agree_known,securedrop,db86920ded3273f0fec3f7cb7287817bf5167000,securedrop/tests/test_journalist.py,CG-SEC-002,known (equal),1339,1338,,,
-67,agree_known,arches,ef3a5efc290afac95e3a6b5e3c8edabd51a9ddab,arches/app/permissions/arches_default_deny.py,CG-QUAL-003,known (equal),230,264,,,
-68,agree_known,habitica,78c62a5aec6f6270ff432de6fdb6efb0e120526d,website/server/controllers/api-v3/tasks.js,CG-SEC-111,known (equal),1017,1018,,,
-69,agree_known,arches,719e7c189df8cc023d756198938d60b280be9c61,arches/app/media/js/views/graph-designer.js,CG-QUAL-104,known (equal),775,777,,,
-70,agree_known,inventree,5244b8a4f21436f699ea266eb5a7381f899409f0,src/backend/InvenTree/plugin/registry.py,CG-QUAL-003,known (equal),688,689,,,
-71,agree_known,readthedocs,6b9919fd2891a30f9f75a99c81fd71d6f09bb821,readthedocs/rtd_tests/tests/test_api.py,CG-SEC-002,known (equal),762,759,,,
-72,agree_known,arches,fbfb7c909265301e0945f9bad49f5c68ae2a76da,arches/app/media/js/viewmodels/map-editor.js,CG-QUAL-104,known (equal),358,359,,,
-73,agree_known,defectdojo,7e2af4942cfddf89ecace7bffb35c0d006d76a53,dojo/static/dojo/js/metrics.js,CG-QUAL-104,known (equal),836,836,,,
-74,agree_known,ckan,ea3c0fd8814de0fa83e744bcb4d5ab5a93902a34,ckan/logic/action/update.py,CG-QUAL-003,known (equal),474,500,,,
-75,agree_known,geonode,e653caf78f3567996934967448a7e959db44236e,geonode/utils.py,CG-SEC-002,known (equal),1061,1061,,,
-76,agree_known,geonode,e653caf78f3567996934967448a7e959db44236e,geonode/utils.py,CG-QUAL-002,known (equal),377,377,,,
-77,agree_known,erpnext,028a9ed1d94ce99702dd65b32ca3aede52b52006,erpnext/stock/doctype/pick_list/pick_list.py,CG-QUAL-005,known (equal),1354,1451,,,
-78,agree_known,kitsune,7558489f48358f1f90ab0dfd5e4cc1a285240693,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),421,568,,,
-79,agree_known,inventree,02da01dfec309ac410e846a57d329d0e96b90e21,src/frontend/src/pages/stock/TransferOrderDetail.tsx,CG-QUAL-101,known (equal),160,166,,,
-80,agree_known,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),633,633,,,
-81,agree_new,ckan,9c010ae0a9dca9967292563ad856ca99079b891f,ckan/public/base/javascript/modules/autocomplete.js,CG-QUAL-104,new,,77,,,
-82,agree_new,lnbits,653924a6dcb6d821a9dae32cd9aac5d287351c57,lnbits/static/i18n/fo.js,CG-SEC-105,new,,300,,,
-83,agree_new,openlibrary,ff9577a078ac1492c1ce4cef0bd53b69e98a692e,openlibrary/bookworm/cli.py,CG-QUAL-003,new,,406,,,
-84,agree_new,inventree,99893f3453c6a213a331c022e82cbafbde7ebd51,src/frontend/src/components/tables/InvenTreeTable.tsx,CG-QUAL-101,new,,940,,,
-85,agree_new,calcom,0d164da8ddc68474300dc85677856950ef81ee7e,apps/web/playwright/fixtures/users.ts,CG-QUAL-103,new,,813,,,
-86,agree_new,erpnext,8c85cef29b0b80a23a499516a94d4319cf45503d,erpnext/stock/doctype/landed_cost_voucher/landed_cost_voucher.js,CG-QUAL-104,new,,119,,,
-87,agree_new,hoppscotch,e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8,packages/hoppscotch-common/src/services/__tests__/ai-chat-ui.spec.ts,CG-PERF-101,new,,325,,,
-88,agree_new,lnbits,7eb996520584b3da9ed865c944e11ddbd2095998,tests/api/test_admin_api.py,CG-QUAL-003,new,,151,,,
-89,agree_new,netbox,9d96894f4e1c622c25de40ccca5847efa5e15153,netbox/utilities/tests/test_ltree.py,CG-SEC-001,new,,1184,,,
-90,agree_new,lnbits,c0806ca59c90464e424f881a92efd8033fd9bd2b,tests/e2e/extension-helpers.ts,CG-PERF-101,new,,540,,,
-91,agree_new,calcom,089a39f59f39f4cd613ab0064dc23117b080c538,apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/update-booking-location.e2e-spec.ts,CG-SEC-105,new,,529,,,
-92,agree_new,edx-platform,294f05f57e3ba73c59b31394cbc2f2c9d6808c14,cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_index.py,CG-SEC-002,new,,279,,,
-93,agree_new,uptime-kuma,e62702d868a0b072c6e1870e5278762319637f04,server/notification-providers/indigo.js,CG-PERF-101,new,,52,,,
-94,agree_new,lnbits,61ed636df066ced4c600a5eb55af147e6d13d130,lnbits/core/services/extensions.py,CG-QUAL-005,new,,268,,,
-95,agree_new,netbox,8cc4548e1f51fcd4cb63299339b55e5ef179e28a,netbox/utilities/ltree.py,CG-SEC-001,new,,287,,,
-96,agree_new,ckan,1902693db45f27bd6a4b93fb0f16b83bba5f79b8,ckan/public/base/javascript/toast.js,CG-SEC-103,new,,162,,,
-97,agree_new,healthchecks,b83e3791d6e2c276a13c0b40c2e435c6ec01125c,hc/integrations/po/static/js/add_pushover.js,CG-QUAL-104,new,,7,,,
-98,agree_new,hoppscotch,e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8,packages/hoppscotch-common/src/services/ai-chat.service.ts,CG-PERF-101,new,,4893,,,
-99,agree_new,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-designer.js,CG-QUAL-104,new,,157,,,
-100,agree_new,healthchecks,cb1926bedaeca358a644e3096cd47d80648abfd3,hc/integrations/telegram/transport.py,CG-QUAL-004,new,,30,,,
+id,item,stratum,repository,commit,path,rule,truth,old_line,line,disagreeing_schemes,verdict,note
+1,F063,edited,arches,403c4626495b979fe831a8f0baf6d8577708e3d7,arches/app/media/js/views/resource/edit-log.js,CG-QUAL-101,known (edited),58,61,codeguard github line_text sonar,,
+2,F053,edited,healthchecks,b83e3791d6e2c276a13c0b40c2e435c6ec01125c,static/js/checks.js,CG-QUAL-104,known (edited),13,13,codeguard github line_text,,
+3,F012,edited,documenso,9c27ce6d185f7e25eec80439b931c4709723a2ae,packages/app-tests/e2e/teams/team-documents.spec.ts,CG-PERF-101,known (edited),37,29,codeguard github line_text sonar,,
+4,F044,edited,pgadmin,5f56805162c117ac1de17368ef8fdc0b07221e2c,web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx,CG-QUAL-101,known (edited),713,749,codeguard github line_text sonar,,
+5,F017,edited,openlibrary,53015559ebcd126850e7b07792ebc7bcfa847919,openlibrary/plugins/openlibrary/js/jsdef.js,CG-QUAL-104,known (edited),77,80,github line_text,,
+6,F013,edited,hoppscotch,863b1b29a803f6c456b04dd82d19a53c7afc9102,packages/hoppscotch-common/src/lib/sync/settings/index.ts,CG-QUAL-101,known (edited),49,42,codeguard github line_text sonar,,
+7,F084,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/buy/purchase.js,CG-QUAL-103,known (edited),79,79,codeguard github line_text sonar,,
+8,F023,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/feed.js,CG-QUAL-103,known (edited),39,37,codeguard github line_text sonar,,
+9,F047,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/buy/hourglassPurchase.js,CG-QUAL-103,known (edited),16,15,codeguard github line_text sonar,,
+10,F060,edited,hedgedoc,2eeb2c72c680f2ce27b22a2d2e43fc86771a02f5,frontend/src/components/render-page/hooks/use-on-html-export-request.ts,CG-SEC-103,known (edited),32,41,codeguard github line_text sonar,,
+11,F087,edited,ghost,0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3,tools/scripts/check-internal-packages.ts,CG-PERF-101,known (edited),285,339,codeguard github line_text sonar,,
+12,F004,edited,kiwi,362febe93063899b8c7468cf7490c26028368a5c,tcms/testplans/static/testplans/js/clone.js,CG-SEC-109,known (edited),110,112,github line_text,,
+13,F055,edited,hoppscotch,9861ee84ad593372885ebfc7cb1c487f3b9dd290,packages/hoppscotch-desktop/src/services/persistence.service.ts,CG-PERF-101,known (edited),112,294,codeguard github line_text sonar,,
+14,F025,edited,uptime-kuma,4e7c4ae382f4038369922a7981babba43403ff1c,test/backend-test/test-migration-v2-to-v3.ts,CG-SEC-105,known (edited),17,21,github line_text sonar,,
+15,F090,edited,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/payment/handleNoShowFee.ts,CG-QUAL-103,known (edited),21,19,line_text,,
+16,F088,edited,hedgedoc,c2ccf48c3966608f7292c6818d1b95469aa1b3cd,backend/src/api/public/notes/notes.controller.ts,CG-PERF-101,known (edited),134,134,codeguard github line_text,,
+17,F021,edited,warehouse,7320d9052b59a7e3b1c2122034396f5d339cd3e0,tests/frontend/filter_list_controller_test.js,CG-SEC-103,known (edited),39,101,codeguard github line_text sonar,,
+18,F005,edited,pgadmin,5f56805162c117ac1de17368ef8fdc0b07221e2c,web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx,CG-QUAL-101,known (edited),813,872,codeguard github line_text sonar,,
+19,F100,edited,indico,4c706171e684907abb2a5a032d81be1c10f919b0,indico/modules/events/registration/util.py,CG-QUAL-003,known (edited),596,596,codeguard github line_text sonar,,
+20,F009,edited,edx-platform,b3f862e61aa84a5f8c027081b7d1a07a8619917d,cms/djangoapps/contentstore/api/views/course_import.py,CG-SEC-013,known (edited),142,145,line_text,,
+21,F066,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1370,1704,codeguard github line_text,,
+22,F037,known_but_new,documenso,97835b8dbb2ca24670c8a410972d949c982c8f61,packages/app-tests/e2e/envelope-editor-v2/envelope-fields.spec.ts,CG-SEC-105,known (equal),1000,1149,codeguard,,
+23,F097,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2486,3172,codeguard line_text,,
+24,F064,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1260,1594,codeguard github,,
+25,F075,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),48,136,codeguard,,
+26,F061,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1395,1728,codeguard line_text,,
+27,F082,known_but_new,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),965,969,codeguard,,
+28,F003,known_but_new,erpnext,750bf9d9b378fb92eab68733ae727214f3961c0a,erpnext/stock/utils.py,CG-PERF-002,known (equal),159,185,codeguard,,
+29,F050,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),52,140,codeguard,,
+30,F080,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2622,3308,codeguard line_text,,
+31,F033,known_but_new,nodebb,9d122948cf783fc72c8c01c7aab0f42b2561b3c3,test/user.js,CG-SEC-105,known (equal),2384,2415,codeguard,,
+32,F010,known_but_new,lnbits,f5989201d9c21a4690334f91bbbb421214c989e7,lnbits/static/js/wasm-extension-component.js,CG-QUAL-102,known (equal),904,1126,codeguard,,
+33,F040,known_but_new,erpnext,ddc764b3608610fa659dd722da44e115850cc4da,erpnext/stock/doctype/material_request/material_request.js,CG-QUAL-101,known (equal),810,809,codeguard,,
+34,F085,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2494,3180,codeguard github line_text,,
+35,F006,known_but_new,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-manager/permission-settings-form.js,CG-QUAL-104,known (equal),128,210,codeguard github line_text,,
+36,F068,known_but_new,nodebb,9d122948cf783fc72c8c01c7aab0f42b2561b3c3,test/user.js,CG-SEC-105,known (equal),1999,2030,codeguard line_text sonar,,
+37,F057,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1267,1601,codeguard,,
+38,F038,known_but_new,nodebb,b8d9cf9d1ee03115d28b3548911e9076a275311a,test/user.js,CG-SEC-105,known (equal),2318,2335,codeguard,,
+39,F062,known_but_new,nodebb,331599fe89bed8c8ae80199efafeee9e81f72dbf,test/topics/crossposts.js,CG-SEC-105,known (equal),660,678,codeguard github line_text,,
+40,F079,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),56,144,codeguard,,
+41,F049,new_but_matched,hoppscotch,803e4633a27be10d80e752d62bd0dab09ed2924a,packages/hoppscotch-backend/src/team-collection/team-collection.service.ts,CG-PERF-101,new,,131,codeguard github line_text sonar,,
+42,F020,new_but_matched,ckan,7a60264189f543fba04043d2193b09f545a6ef32,ckan/public-midnight-blue/base/javascript/modules/data-viewer.js,CG-QUAL-104,new,,27,sonar,,
+43,F081,new_but_matched,pgadmin,a4bdcff7dc65e1b667b981574a7c7263bc84afd2,web/pgadmin/misc/cloud/static/js/cloud_components.jsx,CG-QUAL-101,new,,58,codeguard,,
+44,F028,new_but_matched,intelowl,80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0,frontend/src/components/auth/utils/validator.jsx,CG-SEC-105,new,,24,sonar,,
+45,F093,new_but_matched,intelowl,80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0,frontend/tests/components/auth/utils/validator.test.jsx,CG-SEC-105,new,,45,sonar,,
+46,F041,new_but_matched,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-designer.js,CG-QUAL-104,new,,148,codeguard github sonar,,
+47,F024,new_but_matched,geonode,6f00ca5b66b2459cf3a6556434d476810cabe0d4,geonode/geoserver/gwc.py,CG-SEC-002,new,,50,line_text,,
+48,F073,new_but_matched,hoppscotch,342d0cbdf0c5435b715dc9f1917b851e413e08e3,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,new,,384,codeguard line_text,,
+49,F067,new_but_matched,ghost,0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3,tools/scripts/test/public-apps.test.ts,CG-PERF-101,new,,67,sonar,,
+50,F059,new_but_matched,immich,e66f2c7615bacbe6a9b156e300fc182e4d1a4fa3,server/src/services/person.service.ts,CG-PERF-101,new,,162,codeguard github sonar,,
+51,F095,new_but_matched,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-manager/permission-settings-form.js,CG-QUAL-104,new,,30,codeguard line_text,,
+52,F070,new_but_matched,readthedocs,857138d4d9659a62ce46f52a358f535b6ffeef75,readthedocs/rtd_tests/tests/test_api.py,CG-SEC-002,new,,331,github line_text,,
+53,F072,new_but_matched,openlibrary,53015559ebcd126850e7b07792ebc7bcfa847919,openlibrary/plugins/openlibrary/js/graphs/plot.js,CG-QUAL-104,new,,20,sonar,,
+54,F015,new_but_matched,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,new,,806,codeguard github line_text,,
+55,F058,new_but_matched,ckan,7a60264189f543fba04043d2193b09f545a6ef32,ckan/public/base/javascript/modules/data-viewer.js,CG-QUAL-104,new,,27,sonar,,
+56,F092,new_but_matched,calcom,1660adeb537a3524290c6885c6b9feca63cf675b,scripts/seed.ts,CG-SEC-105,new,,1008,codeguard github line_text sonar,,
+57,F035,new_but_matched,hoppscotch,863b1b29a803f6c456b04dd82d19a53c7afc9102,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,new,,511,sonar,,
+58,F001,new_but_matched,ghost,7da91e095b2803c62bc67fe70f2c4f0d114846d9,tools/scripts/test/ci-path-filters.test.js,CG-PERF-101,new,,69,codeguard line_text,,
+59,F099,new_but_matched,arches,ac6a5ab6907f92256a1ebdbc373de7cabb41e3b0,arches/app/media/js/views/graph-designer.js,CG-QUAL-104,new,,793,sonar,,
+60,F069,new_but_matched,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,new,,844,codeguard,,
+61,F032,agree_known,ckan,fd309bc144f08505087d8b8d463aa8da296ba766,ckan/public/base/javascript/client.js,CG-QUAL-104,known (equal),227,226,,,
+62,F043,agree_known,hoppscotch,1855faabbc4ff968d874f54510f6c586a7fdae05,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,known (equal),796,799,,,
+63,F011,agree_known,indico,1ab29e13596cacf234ce75f7c0d4be217010ba6d,indico/modules/events/registration/util.py,CG-QUAL-003,known (equal),474,474,,,
+64,F034,agree_known,securedrop,871378be59567ac2916c1ae5d8f347784288d46f,securedrop/tests/test_journalist_api2.py,CG-QUAL-003,known (equal),738,738,,,
+65,F091,agree_known,weblate,f4e6cc3fe00e4ea1c0dd849af897442246f14191,weblate/trans/tests/test_autotranslate.py,CG-QUAL-004,known (equal),1621,1639,,,
+66,F026,agree_known,securedrop,db86920ded3273f0fec3f7cb7287817bf5167000,securedrop/tests/test_journalist.py,CG-SEC-002,known (equal),1339,1338,,,
+67,F022,agree_known,arches,ef3a5efc290afac95e3a6b5e3c8edabd51a9ddab,arches/app/permissions/arches_default_deny.py,CG-QUAL-003,known (equal),230,264,,,
+68,F045,agree_known,habitica,78c62a5aec6f6270ff432de6fdb6efb0e120526d,website/server/controllers/api-v3/tasks.js,CG-SEC-111,known (equal),1017,1018,,,
+69,F089,agree_known,arches,719e7c189df8cc023d756198938d60b280be9c61,arches/app/media/js/views/graph-designer.js,CG-QUAL-104,known (equal),775,777,,,
+70,F019,agree_known,inventree,5244b8a4f21436f699ea266eb5a7381f899409f0,src/backend/InvenTree/plugin/registry.py,CG-QUAL-003,known (equal),688,689,,,
+71,F029,agree_known,readthedocs,6b9919fd2891a30f9f75a99c81fd71d6f09bb821,readthedocs/rtd_tests/tests/test_api.py,CG-SEC-002,known (equal),762,759,,,
+72,F030,agree_known,arches,fbfb7c909265301e0945f9bad49f5c68ae2a76da,arches/app/media/js/viewmodels/map-editor.js,CG-QUAL-104,known (equal),358,359,,,
+73,F031,agree_known,defectdojo,7e2af4942cfddf89ecace7bffb35c0d006d76a53,dojo/static/dojo/js/metrics.js,CG-QUAL-104,known (equal),836,836,,,
+74,F018,agree_known,ckan,ea3c0fd8814de0fa83e744bcb4d5ab5a93902a34,ckan/logic/action/update.py,CG-QUAL-003,known (equal),474,500,,,
+75,F048,agree_known,geonode,e653caf78f3567996934967448a7e959db44236e,geonode/utils.py,CG-SEC-002,known (equal),1061,1061,,,
+76,F039,agree_known,geonode,e653caf78f3567996934967448a7e959db44236e,geonode/utils.py,CG-QUAL-002,known (equal),377,377,,,
+77,F002,agree_known,erpnext,028a9ed1d94ce99702dd65b32ca3aede52b52006,erpnext/stock/doctype/pick_list/pick_list.py,CG-QUAL-005,known (equal),1354,1451,,,
+78,F071,agree_known,kitsune,7558489f48358f1f90ab0dfd5e4cc1a285240693,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),421,568,,,
+79,F046,agree_known,inventree,02da01dfec309ac410e846a57d329d0e96b90e21,src/frontend/src/pages/stock/TransferOrderDetail.tsx,CG-QUAL-101,known (equal),160,166,,,
+80,F016,agree_known,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),633,633,,,
+81,F052,agree_new,ckan,9c010ae0a9dca9967292563ad856ca99079b891f,ckan/public/base/javascript/modules/autocomplete.js,CG-QUAL-104,new,,77,,,
+82,F078,agree_new,lnbits,653924a6dcb6d821a9dae32cd9aac5d287351c57,lnbits/static/i18n/fo.js,CG-SEC-105,new,,300,,,
+83,F083,agree_new,openlibrary,ff9577a078ac1492c1ce4cef0bd53b69e98a692e,openlibrary/bookworm/cli.py,CG-QUAL-003,new,,406,,,
+84,F007,agree_new,inventree,99893f3453c6a213a331c022e82cbafbde7ebd51,src/frontend/src/components/tables/InvenTreeTable.tsx,CG-QUAL-101,new,,940,,,
+85,F036,agree_new,calcom,0d164da8ddc68474300dc85677856950ef81ee7e,apps/web/playwright/fixtures/users.ts,CG-QUAL-103,new,,813,,,
+86,F014,agree_new,erpnext,8c85cef29b0b80a23a499516a94d4319cf45503d,erpnext/stock/doctype/landed_cost_voucher/landed_cost_voucher.js,CG-QUAL-104,new,,119,,,
+87,F056,agree_new,hoppscotch,e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8,packages/hoppscotch-common/src/services/__tests__/ai-chat-ui.spec.ts,CG-PERF-101,new,,325,,,
+88,F065,agree_new,lnbits,7eb996520584b3da9ed865c944e11ddbd2095998,tests/api/test_admin_api.py,CG-QUAL-003,new,,151,,,
+89,F027,agree_new,netbox,9d96894f4e1c622c25de40ccca5847efa5e15153,netbox/utilities/tests/test_ltree.py,CG-SEC-001,new,,1184,,,
+90,F008,agree_new,lnbits,c0806ca59c90464e424f881a92efd8033fd9bd2b,tests/e2e/extension-helpers.ts,CG-PERF-101,new,,540,,,
+91,F096,agree_new,calcom,089a39f59f39f4cd613ab0064dc23117b080c538,apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/update-booking-location.e2e-spec.ts,CG-SEC-105,new,,529,,,
+92,F054,agree_new,edx-platform,294f05f57e3ba73c59b31394cbc2f2c9d6808c14,cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_index.py,CG-SEC-002,new,,279,,,
+93,F074,agree_new,uptime-kuma,e62702d868a0b072c6e1870e5278762319637f04,server/notification-providers/indigo.js,CG-PERF-101,new,,52,,,
+94,F094,agree_new,lnbits,61ed636df066ced4c600a5eb55af147e6d13d130,lnbits/core/services/extensions.py,CG-QUAL-005,new,,268,,,
+95,F042,agree_new,netbox,8cc4548e1f51fcd4cb63299339b55e5ef179e28a,netbox/utilities/ltree.py,CG-SEC-001,new,,287,,,
+96,F051,agree_new,ckan,1902693db45f27bd6a4b93fb0f16b83bba5f79b8,ckan/public/base/javascript/toast.js,CG-SEC-103,new,,162,,,
+97,F077,agree_new,healthchecks,b83e3791d6e2c276a13c0b40c2e435c6ec01125c,hc/integrations/po/static/js/add_pushover.js,CG-QUAL-104,new,,7,,,
+98,F086,agree_new,hoppscotch,e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8,packages/hoppscotch-common/src/services/ai-chat.service.ts,CG-PERF-101,new,,4893,,,
+99,F098,agree_new,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-designer.js,CG-QUAL-104,new,,157,,,
+100,F076,agree_new,healthchecks,cb1926bedaeca358a644e3096cd47d80648abfd3,hc/integrations/telegram/transport.py,CG-QUAL-004,new,,30,,,
diff --git a/research/finding_identity/paper/outline.md b/research/finding_identity/paper/outline.md
index 3753aa5..8160032 100644
--- a/research/finding_identity/paper/outline.md
+++ b/research/finding_identity/paper/outline.md
@@ -154,8 +154,10 @@ only" gate built on set membership can hide new vulnerabilities.
 ## VII. Threats to validity
 
 - Ground truth is a line diff: a finding whose line is rewritten beyond the similarity
-  threshold counts as removed plus introduced. Mitigation: a manual check of a stratified
-  sample (to do, see claims.md).
+  threshold counts as removed plus introduced. A manual check of 100 stratified findings
+  (claims G1–G6) shows it holds for 98% of persisting findings but 75% of introduced
+  ones, with the errors where a scheme matched an "introduced" finding; the hidden rates
+  are therefore upper bounds (SonarQube's corrects from 1.5% to about 0.2%).
 - Findings come mostly from one analyzer; Bandit's own findings replicate the key
   results for Python.
 - Ports, not the tools: each checked against the original (Section III), but SonarQube's
diff --git a/research/finding_identity/tests/test_gt_agreement.py b/research/finding_identity/tests/test_gt_agreement.py
new file mode 100644
index 0000000..e241a94
--- /dev/null
+++ b/research/finding_identity/tests/test_gt_agreement.py
@@ -0,0 +1,92 @@
+# SPDX-License-Identifier: Apache-2.0
+
+"""Scoring the manual ground-truth check."""
+
+import json
+from pathlib import Path
+
+from research.finding_identity.gt_agreement import (
+    cohen_kappa,
+    judgement,
+    load_labels,
+    precision_rows,
+    report,
+)
+
+
+def test_cohen_kappa_against_hand_computed_values() -> None:
+    # 4 of 6 agree; marginals a = {x: 3, y: 3}, b = {x: 3, y: 3}: pe = 0.5, kappa = 1/3.
+    a = ["x", "x", "x", "y", "y", "y"]
+    b = ["x", "x", "y", "y", "y", "x"]
+    assert abs(cohen_kappa(a, b) - 1 / 3) < 1e-12  # type: ignore[operator]
+    assert cohen_kappa(a, a) == 1.0
+    assert cohen_kappa(["x", "x"], ["x", "x"]) is None  # chance agreement is total
+    assert cohen_kappa([], []) is None
+
+
+def test_judgement_maps_both_question_kinds() -> None:
+    assert judgement("same") == judgement("new") == "confirms"
+    assert judgement("different") == judgement("existed") == "contradicts"
+    assert judgement("unclear") == judgement(None) == "unclear"
+
+
+def test_load_labels_from_a_file_and_from_exported_documents(tmp_path: Path) -> None:
+    f = tmp_path / "agent.json"
+    f.write_text(json.dumps({"F001": {"verdict": "same", "reason": "r"}, "F002": {}}))
+    assert load_labels(f) == {"F001": "same"}
+    d = tmp_path / "export" / "data" / "labels" / "items"
+    d.mkdir(parents=True)
+    (d / "F001.json").write_text(json.dumps({"verdict": "new", "note": ""}))
+    (d / "F002.json").write_text(json.dumps({"data": {"verdict": "existed"}, "version": 3}))
+    assert load_labels(tmp_path / "export") == {"F001": "new", "F002": "existed"}
+
+
+def test_precision_rows_and_report() -> None:
+    key = [
+        {"item": "F001", "stratum": "a", "truth": "known (equal)"},
+        {"item": "F002", "stratum": "a", "truth": "new"},
+        {"item": "F003", "stratum": "b", "truth": "known (edited)"},
+    ]
+    human = {"F001": "same", "F002": "existed", "F003": "unclear"}
+    rows = precision_rows(key, human, "stratum")
+    assert rows == [("a", 1, 1, 0), ("b", 0, 0, 1), ("all", 1, 1, 1)]
+    text = report(key, {"Human rater": human, "Agent rater": {"F001": "same", "F002": "new"}})
+    assert "| a | 1 | 1 | 0 | 50.0% |" in text
+    assert "1 agree (50.0%)" in text and "Items to adjudicate: F002." in text
+
+
+def test_corresponding_old_line_follows_the_line_map() -> None:
+    from research.finding_identity.gt_sample import corresponding_old_line
+
+    old = ["a", "b", "c", "d"]
+    new = ["a", "b", "x = eval(y)", "c", "d"]
+    # The flagged line was inserted after "b": its place before the commit is old line 3.
+    assert corresponding_old_line(old, new, 3) == (3, False)
+    # An unchanged line maps back to itself.
+    assert corresponding_old_line(old, new, 4) == (3, True)
+    # A line added at the very top has no line above it.
+    assert corresponding_old_line(old, ["new", *old], 1) == (1, False)
+
+
+def test_corrected_hidden_scales_by_the_confirmed_share(tmp_path: Path) -> None:
+    from research.finding_identity.gt_agreement import corrected_hidden
+
+    run = tmp_path / "repo"
+    run.mkdir()
+    base = {"line_text": "new_ok", "github": "new_ok", "codeguard": "new_ok"}
+    records = [
+        {"truth": "new", "outcomes": {**base, "sonar": "false_known"}},
+        {"truth": "new", "outcomes": {**base, "sonar": "false_known"}},
+        {"truth": "new", "outcomes": {**base, "sonar": "new_ok"}},
+        {"truth": "new", "outcomes": {**base, "sonar": "new_ok"}},
+        {"truth": "known", "outcomes": {**base, "sonar": "known_ok"}},
+    ]
+    (run / "findings.jsonl").write_text("".join(json.dumps(r) + "\n" for r in records))
+    key = [
+        {"item": "A", "stratum": "new_but_matched", "disagreeing_schemes": "sonar"},
+        {"item": "B", "stratum": "new_but_matched", "disagreeing_schemes": "sonar"},
+    ]
+    lines = corrected_hidden(key, {"A": "new", "B": "existed"}, tmp_path)
+    # Hidden 2 of 4 introduced (50%); half the sampled matches are truly new: 25%.
+    row = next(x for x in lines if x.startswith("| `sonar`"))
+    assert row.startswith("| `sonar` | 50.00% (2) | 2 | 1 | 25.00% |")